john-crack

John the Ripper Offline Password Cracking Methodology

John the Ripper is the most classic offline password cracking tool. Core advantages:Automatic hash identification + Rich rule engine + *2john extraction toolchain. Supports 200+ hash types.

Project address:https://github.com/openwall/john

Phase 1: Basic cracking

# 自动检测哈希类型并破解
john hashes.txt

# 指定哈希格式
john --format=Raw-MD5 hashes.txt
john --format=NT hashes.txt
john --format=Raw-SHA256 hashes.txt

# 字典攻击
john --wordlist=rockyou.txt hashes.txt

View cracked passwords

john --show hashes.txt

## Phase 2: 规则变形攻击

```bash
# 字典 + 默认规则
john --wordlist=rockyou.txt --rules hashes.txt

# 字典 + best64 规则（最常用）
john --wordlist=rockyou.txt --rules=best64 hashes.txt

# 字典 + Jumbo 规则（更全面）
john --wordlist=rockyou.txt --rules=Jumbo hashes.txt

# 字典 + KoreLogic 规则（最复杂，最慢）
john --wordlist=rockyou.txt --rules=KoreLogic hashes.txt

# 列出可用规则
john --list=rules

Phase 3: Hash extraction (*2john toolchain)

# ZIP 文件
zip2john secret.zip > zip_hash.txt
john zip_hash.txt

# RAR 文件
rar2john secret.rar > rar_hash.txt

# PDF 文件
pdf2john.pl secret.pdf > pdf_hash.txt

# SSH 私钥
ssh2john id_rsa > ssh_hash.txt

# KeePass 数据库
keepass2john database.kdbx > keepass_hash.txt

# Office 文档
office2john document.docx > office_hash.txt

# Kerberos TGS (Kerberoasting)
john --format=krb5tgs --wordlist=rockyou.txt tgs_hashes.txt

# Kerberos AS-REP (AS-REP Roasting)
john --format=krb5asrep --wordlist=rockyou.txt asrep_hashes.txt

# NTLM Hash
john --format=NT --wordlist=rockyou.txt ntlm_hashes.txt

Phase 4: Incremental and mask attacks

# 增量模式（纯暴力，自动递增长度）
john --incremental hashes.txt

# 指定字符集
john --incremental=Digits hashes.txt     # 纯数字
john --incremental=Alnum hashes.txt      # 字母数字
john --incremental=ASCII hashes.txt      # 全 ASCII

# 掩码攻击（Hashcat 风格）
john --mask='?d?d?d?d?d?d' hashes.txt          # 6 位数字
john --mask='?u?l?l?l?d?d?d?s' hashes.txt      # 大写+小写x3+数字x3+特殊

Phase 5: Practical tips

# 恢复中断的破解
john --restore

# 查看当前进度
john --status

# 多核并行
john --fork=4 --wordlist=rockyou.txt hashes.txt

# 指定会话名称
john --session=my_crack --wordlist=rockyou.txt hashes.txt

# 只破解特定用户
john --users=admin hashes.txt

Common penetration testing scenarios

Scenario	Command
NTLM cracking	john --format=NT --wordlist=rockyou.txt ntlm.txt
Kerberoasting	john --format=krb5tgs --wordlist=rockyou.txt tgs.txt
SSH key cracking	ssh2john id_rsa > h.txt && john --wordlist=rockyou.txt h.txt
ZIP password cracking	zip2john file.zip > h.txt && john h.txt
Linux shadow	john --wordlist=rockyou.txt /tmp/shadow
Dictionary + rules	john --wordlist=rockyou.txt --rules=best64 hashes.txt