# John the ripper

Repo: [John the Ripper](https://github.com/openwall/john)

## Encryption technologies

| **Encryption Technology**                 | **Description**                                                                                                                   |
| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| `UNIX crypt(3)`                           | Crypt(3) is a traditional UNIX encryption system with a 56-bit key.                                                               |
| `Traditional DES-based`                   | DES-based encryption uses the Data Encryption Standard algorithm to encrypt data.                                                 |
| `bigcrypt`                                | Bigcrypt is an extension of traditional DES-based encryption. It uses a 128-bit key.                                              |
| `BSDI extended DES-based`                 | BSDI extended DES-based encryption is an extension of the traditional DES-based encryption and uses a 168-bit key.                |
| `FreeBSD MD5-based` (Linux & Cisco)       | FreeBSD MD5-based encryption uses the MD5 algorithm to encrypt data with a 128-bit key.                                           |
| `OpenBSD Blowfish-based`                  | OpenBSD Blowfish-based encryption uses the Blowfish algorithm to encrypt data with a 448-bit key.                                 |
| `Kerberos/AFS`                            | Kerberos and AFS are authentication systems that use encryption to ensure secure entity communication.                            |
| `Windows LM`                              | Windows LM encryption uses the Data Encryption Standard algorithm to encrypt data with a 56-bit key.                              |
| `DES-based tripcodes`                     | DES-based tripcodes are used to authenticate users based on the Data Encryption Standard algorithm.                               |
| `SHA-crypt hashes`                        | SHA-crypt hashes are used to encrypt data with a 256-bit key and are available in newer versions of Fedora and Ubuntu.            |
| `SHA-crypt` and `SUNMD5 hashes` (Solaris) | SHA-crypt and SUNMD5 hashes use the SHA-crypt and MD5 algorithms to encrypt data with a 256-bit key and are available in Solaris. |
| `...`                                     | and many more.                                                                                                                    |

## Attack Methods

* Dictionary
* Brute force
* Rainbow Tables

## **Cracking with John**

<table data-header-hidden><thead><tr><th width="206"></th><th></th><th></th></tr></thead><tbody><tr><td><strong>Hash Format</strong></td><td><strong>Example Command</strong></td><td><strong>Description</strong></td></tr><tr><td>afs</td><td><code>john --format=afs hashes_to_crack.txt</code></td><td>AFS (Andrew File System) password hashes</td></tr><tr><td>bfegg</td><td><code>john --format=bfegg hashes_to_crack.txt</code></td><td>bfegg hashes used in Eggdrop IRC bots</td></tr><tr><td>bf</td><td><code>john --format=bf hashes_to_crack.txt</code></td><td>Blowfish-based crypt(3) hashes</td></tr><tr><td>bsdi</td><td><code>john --format=bsdi hashes_to_crack.txt</code></td><td>BSDi crypt(3) hashes</td></tr><tr><td>crypt(3)</td><td><code>john --format=crypt hashes_to_crack.txt</code></td><td>Traditional Unix crypt(3) hashes</td></tr><tr><td>des</td><td><code>john --format=des hashes_to_crack.txt</code></td><td>Traditional DES-based crypt(3) hashes</td></tr><tr><td>dmd5</td><td><code>john --format=dmd5 hashes_to_crack.txt</code></td><td>DMD5 (Dragonfly BSD MD5) password hashes</td></tr><tr><td>dominosec</td><td><code>john --format=dominosec hashes_to_crack.txt</code></td><td>IBM Lotus Domino 6/7 password hashes</td></tr><tr><td>EPiServer SID hashes</td><td><code>john --format=episerver hashes_to_crack.txt</code></td><td>EPiServer SID (Security Identifier) password hashes</td></tr><tr><td>hdaa</td><td><code>john --format=hdaa hashes_to_crack.txt</code></td><td>hdaa password hashes used in Openwall GNU/Linux</td></tr><tr><td>hmac-md5</td><td><code>john --format=hmac-md5 hashes_to_crack.txt</code></td><td>hmac-md5 password hashes</td></tr><tr><td>hmailserver</td><td><code>john --format=hmailserver hashes_to_crack.txt</code></td><td>hmailserver password hashes</td></tr><tr><td>ipb2</td><td><code>john --format=ipb2 hashes_to_crack.txt</code></td><td>Invision Power Board 2 password hashes</td></tr><tr><td>krb4</td><td><code>john --format=krb4 hashes_to_crack.txt</code></td><td>Kerberos 4 password hashes</td></tr><tr><td>krb5</td><td><code>john --format=krb5 hashes_to_crack.txt</code></td><td>Kerberos 5 password hashes</td></tr><tr><td>LM</td><td><code>john --format=LM hashes_to_crack.txt</code></td><td>LM (Lan Manager) password hashes</td></tr><tr><td>lotus5</td><td><code>john --format=lotus5 hashes_to_crack.txt</code></td><td>Lotus Notes/Domino 5 password hashes</td></tr><tr><td>mscash</td><td><code>john --format=mscash hashes_to_crack.txt</code></td><td>MS Cache password hashes</td></tr><tr><td>mscash2</td><td><code>john --format=mscash2 hashes_to_crack.txt</code></td><td>MS Cache v2 password hashes</td></tr><tr><td>mschapv2</td><td><code>john --format=mschapv2 hashes_to_crack.txt</code></td><td>MS CHAP v2 password hashes</td></tr><tr><td>mskrb5</td><td><code>john --format=mskrb5 hashes_to_crack.txt</code></td><td>MS Kerberos 5 password hashes</td></tr><tr><td>mssql05</td><td><code>john --format=mssql05 hashes_to_crack.txt</code></td><td>MS SQL 2005 password hashes</td></tr><tr><td>mssql</td><td><code>john --format=mssql hashes_to_crack.txt</code></td><td>MS SQL password hashes</td></tr><tr><td>mysql-fast</td><td><code>john --format=mysql-fast hashes_to_crack.txt</code></td><td>MySQL fast password hashes</td></tr><tr><td>mysql</td><td><code>john --format=mysql hashes_to_crack.txt</code></td><td>MySQL password hashes</td></tr><tr><td>mysql-sha1</td><td><code>john --format=mysql-sha1 hashes_to_crack.txt</code></td><td>MySQL SHA1 password hashes</td></tr><tr><td>NETLM</td><td><code>john --format=netlm hashes_to_crack.txt</code></td><td>NETLM (NT LAN Manager) password hashes</td></tr><tr><td>NETLMv2</td><td><code>john --format=netlmv2 hashes_to_crack.txt</code></td><td>NETLMv2 (NT LAN Manager version 2) password hashes</td></tr><tr><td>NETNTLM</td><td><code>john --format=netntlm hashes_to_crack.txt</code></td><td>NETNTLM (NT LAN Manager) password hashes</td></tr><tr><td>NETNTLMv2</td><td><code>john --format=netntlmv2 hashes_to_crack.txt</code></td><td>NETNTLMv2 (NT LAN Manager version 2) password hashes</td></tr><tr><td>NEThalfLM</td><td><code>john --format=nethalflm hashes_to_crack.txt</code></td><td>NEThalfLM (NT LAN Manager) password hashes</td></tr><tr><td>md5ns</td><td><code>john --format=md5ns hashes_to_crack.txt</code></td><td>md5ns (MD5 namespace) password hashes</td></tr><tr><td>nsldap</td><td><code>john --format=nsldap hashes_to_crack.txt</code></td><td>nsldap (OpenLDAP SHA) password hashes</td></tr><tr><td>ssha</td><td><code>john --format=ssha hashes_to_crack.txt</code></td><td>ssha (Salted SHA) password hashes</td></tr><tr><td>NT</td><td><code>john --format=nt hashes_to_crack.txt</code></td><td>NT (Windows NT) password hashes</td></tr><tr><td>openssha</td><td><code>john --format=openssha hashes_to_crack.txt</code></td><td>OPENSSH private key password hashes</td></tr><tr><td>oracle11</td><td><code>john --format=oracle11 hashes_to_crack.txt</code></td><td>Oracle 11 password hashes</td></tr><tr><td>oracle</td><td><code>john --format=oracle hashes_to_crack.txt</code></td><td>Oracle password hashes</td></tr><tr><td>pdf</td><td><code>john --format=pdf hashes_to_crack.txt</code></td><td>PDF (Portable Document Format) password hashes</td></tr><tr><td>phpass-md5</td><td><code>john --format=phpass-md5 hashes_to_crack.txt</code></td><td>PHPass-MD5 (Portable PHP password hashing framework) password hashes</td></tr><tr><td>phps</td><td><code>john --format=phps hashes_to_crack.txt</code></td><td>PHPS password hashes</td></tr><tr><td>pix-md5</td><td><code>john --format=pix-md5 hashes_to_crack.txt</code></td><td>Cisco PIX MD5 password hashes</td></tr><tr><td>po</td><td><code>john --format=po hashes_to_crack.txt</code></td><td>Po (Sybase SQL Anywhere) password hashes</td></tr><tr><td>rar</td><td><code>john --format=rar hashes_to_crack.txt</code></td><td>RAR (WinRAR) password hashes</td></tr><tr><td>raw-md4</td><td><code>john --format=raw-md4 hashes_to_crack.txt</code></td><td>Raw MD4 password hashes</td></tr><tr><td>raw-md5</td><td><code>john --format=raw-md5 hashes_to_crack.txt</code></td><td>Raw MD5 password hashes</td></tr><tr><td>raw-md5-unicode</td><td><code>john --format=raw-md5-unicode hashes_to_crack.txt</code></td><td>Raw MD5 Unicode password hashes</td></tr><tr><td>raw-sha1</td><td><code>john --format=raw-sha1 hashes_to_crack.txt</code></td><td>Raw SHA1 password hashes</td></tr><tr><td>raw-sha224</td><td><code>john --format=raw-sha224 hashes_to_crack.txt</code></td><td>Raw SHA224 password hashes</td></tr><tr><td>raw-sha256</td><td><code>john --format=raw-sha256 hashes_to_crack.txt</code></td><td>Raw SHA256 password hashes</td></tr><tr><td>raw-sha384</td><td><code>john --format=raw-sha384 hashes_to_crack.txt</code></td><td>Raw SHA384 password hashes</td></tr><tr><td>raw-sha512</td><td><code>john --format=raw-sha512 hashes_to_crack.txt</code></td><td>Raw SHA512 password hashes</td></tr><tr><td>salted-sha</td><td><code>john --format=salted-sha hashes_to_crack.txt</code></td><td>Salted SHA password hashes</td></tr><tr><td>sapb</td><td><code>john --format=sapb hashes_to_crack.txt</code></td><td>SAP CODVN B (BCODE) password hashes</td></tr><tr><td>sapg</td><td><code>john --format=sapg hashes_to_crack.txt</code></td><td>SAP CODVN G (PASSCODE) password hashes</td></tr><tr><td>sha1-gen</td><td><code>john --format=sha1-gen hashes_to_crack.txt</code></td><td>Generic SHA1 password hashes</td></tr><tr><td>skey</td><td><code>john --format=skey hashes_to_crack.txt</code></td><td>S/Key (One-time password) hashes</td></tr><tr><td>ssh</td><td><code>john --format=ssh hashes_to_crack.txt</code></td><td>SSH (Secure Shell) password hashes</td></tr><tr><td>sybasease</td><td><code>john --format=sybasease hashes_to_crack.txt</code></td><td>Sybase ASE password hashes</td></tr><tr><td>xsha</td><td><code>john --format=xsha hashes_to_crack.txt</code></td><td>xsha (Extended SHA) password hashes</td></tr><tr><td>zip</td><td><code>john --format=zip hashes_to_crack.txt</code></td><td>ZIP (WinZip) password hashes</td></tr></tbody></table>

## Cracking Modes

### Single Crack Mode

```bash
john --format=<hash_type> <hash or hash_file>
```

When we run the command, John will read the hashes from the specified file, and then it will try to crack them by comparing them to the words in its built-in wordlist and any additional wordlists specified with the `--wordlist` option. Additionally, It will use any rules set with the `--rules` option (if any rules are given) to generate further candidate passwords.

John will output the cracked passwords to the console and the file "john.pot" (`~/.john/john.pot`) to the current user's home directory. Furthermore, it will continue cracking the remaining hashes in the background, and we can check the progress by running the `john --show` command. To maximize the chances of success, it is important to ensure that the wordlists and rules used are comprehensive and up to date.

[See table above](#cracking-with-john)

### **Wordlist Mode**

`Wordlist Mode` is used to crack passwords using multiple lists of words. It is a dictionary attack which means it will try all the words in the lists one by one until it finds the right one. It is generally used for cracking multiple password hashes using a wordlist or a combination of wordlists. It is more effective than Single Crack Mode because it utilizes more words but is still relatively basic. The basic syntax for the command is:

```bash
john --wordlist=<wordlist_file> --rules <hash_file>
```

### **Incremental Mode**

`Incremental Mode` is an advanced John mode used to crack passwords using a character set. It is a hybrid attack, which means it will attempt to match the password by trying all possible combinations of characters from the character set. This mode is the most effective yet most time-consuming of all the John modes. This mode works best when we know what the password might be, as it will try all the possible combinations in sequence, starting from the shortest one. This makes it much faster than the brute force attack, where all combinations are tried randomly. Moreover, the incremental mode can also be used to crack weak passwords, which may be challenging to crack using the standard John modes. The main difference between incremental mode and wordlist mode is the source of the password guesses. Incremental mode generates the guesses on the fly, while wordlist mode uses a predefined list of words. At the same time, the single crack mode is used to check a single password against a hash.

```bash
john --incremental <hash_file>
```

Using this command we will read the hashes in the specified hash file and then generate all possible combinations of characters, starting with a single character and incrementing with each iteration. It is important to note that this mode is `highly resource intensive` and can take a long time to complete, depending on the complexity of the passwords, machine configuration, and the number of characters set. Additionally, it is important to note that the default character set is limited to `a-zA-Z0-9`. Therefore, if we attempt to crack complex passwords with special characters, we need to use a custom character set.

## Cracking Files

```bash
<tool> <file_to_crack> > file.hash
pdf2john server_doc.pdf > server_doc.hash
john server_doc.hash
    # OR
john --wordlist=<wordlist.txt> server_doc.hash 
```

| **Tool**                | **Description**                               |
| ----------------------- | --------------------------------------------- |
| `pdf2john`              | Converts PDF documents for John               |
| `ssh2john`              | Converts SSH private keys for John            |
| `mscash2john`           | Converts MS Cash hashes for John              |
| `keychain2john`         | Converts OS X keychain files for John         |
| `rar2john`              | Converts RAR archives for John                |
| `pfx2john`              | Converts PKCS#12 files for John               |
| `truecrypt_volume2john` | Converts TrueCrypt volumes for John           |
| `keepass2john`          | Converts KeePass databases for John           |
| `vncpcap2john`          | Converts VNC PCAP files for John              |
| `putty2john`            | Converts PuTTY private keys for John          |
| `zip2john`              | Converts ZIP archives for John                |
| `hccap2john`            | Converts WPA/WPA2 handshake captures for John |
| `office2john`           | Converts MS Office documents for John         |
| `wpa2john`              | Converts WPA/WPA2 handshakes for John         |

More of these tools can be found:

```bash
locate *2john*
```