John The Ripper

John the Ripper (often referred to as "John") is a widely-used password cracking tool designed for detecting weak passwords. It supports various cryptographic hash types and can perform different attack modes to recover passwords.

Key Usages:

1. Basic Password Cracking: By default, John uses a built-in wordlist and simple rules.

   john hashes.txt

2. Specifying a Wordlist: Use a custom wordlist for dictionary attacks.

   john --wordlist=wordlist.txt hashes.txt

3. Incremental Mode (Brute Force): Attempts all possible character combinations.

   john --incremental hashes.txt

4. Single Crack Mode: Uses the username and GECOS information to generate password guesses.

   john --single hashes.txt

5. External Mode: Allows for custom cracking algorithms using C-like syntax.

   john --external=MODE hashes.txt

Tips and Tricks:

1. Using --show to Display Cracked Passwords: After cracking, use --show to see the results.

   john --show hashes.txt

2. Resume Cracking: If you need to stop and resume later, John supports session management.

   john --session=yourSessionName hashes.txt
   john --restore=yourSessionName

3. Using Rules to Enhance Dictionary Attacks: Apply rules to generate variations of words from the wordlist.

   john --wordlist=wordlist.txt --rules hashes.txt

4. Adjusting Cracking Mode Settings: Customize settings for incremental mode.

   john --incremental=alpha --min-length=8 --max-length=12 hashes.txt

5. Cracking Specific Hash Types: Explicitly specify the hash format if John does not auto-detect it.

   john --format=NT hashes.txt

6. Combining Wordlists: Use multiple wordlists to increase the chances of finding the password.

   john --wordlist=wordlist1.txt --wordlist=wordlist2.txt hashes.txt

7. Parallel Cracking with MPI: For faster results, use MPI to run John in parallel on multiple processors.

   mpiexec -np 4 john hashes.txt