John the Ripper Cheat Sheet

John the Ripper takes a hash you've already obtained — dumped from a compromised system, extracted from a config file, cracked open via responder — and turns it back into a plaintext password.

Red Team / Offensive Use

John shows up in the back half of an engagement: you've already got a hash (from hashdump, a captured NTLMv2 hash via Responder, a /etc/shadow file, a cracked keepass database, whatever), and now you need the actual password — either to reuse those credentials elsewhere, or because password reuse itself is the finding worth reporting. Format detection and rule-based mangling (trying common substitutions like password → p@ssw0rd) do most of the real work.

Established Cheatsheet

Openwall — John the Ripper — the official project site, authoritative on supported hash formats and current syntax across the jumbo and core versions.

PWNMI's Top 5 Use Cases

• john --format=nt hashes.txt — crack NTLM hashes, the format you'll hit constantly against Windows/AD targets
• john --wordlist=rockyou.txt hashes.txt — dictionary attack against a wordlist; the default first move before anything more exotic
• john --wordlist=rockyou.txt --rules hashes.txt — same, but with rule-based mangling applied to each wordlist entry (case changes, appended digits, common substitutions) — often the difference between a miss and a crack
• john --show hashes.txt — display already-cracked passwords from a prior run without re-cracking
• john --format=nt --incremental hashes.txt — brute-force mode as a last resort once wordlist and rule-based attempts are exhausted; slow, but exhaustive

Next step

Getting the hash in the first place is usually the harder half — see the script privesc checklist for one common path to finding credentials worth cracking in the first place.