John the Ripper
tips & tricks.

Installation

The community-supported "jumbo" build ships with most of the format-specific extractors you'll need. On Debian/Ubuntu:

sudo apt install john

For the latest jumbo features (Office, ODF, RAR5, many more formats) build from source:

git clone https://github.com/openwall/john.git
cd john/src
./configure && make -s clean && make -sj4
cd ../run
./john --test=0

Extracting hashes with *2john

John rarely operates on the original file directly. Each supported format has a matching extractor that emits a John-compatible hash line:

• office2john.py <doc.docx> — Microsoft Office files
• libreoffice2john.py <file.odt> — OpenDocument files
• zip2john <archive.zip> — ZIP archives
• rar2john <archive.rar> — RAR3/RAR5 archives
• pdf2john.pl <file.pdf> — PDF files
• keepass2john <file.kdbx> — KeePass databases

Pipe the output to a file and feed it to John:

office2john.py secret.docx > hash.txt
john --wordlist=rockyou.txt hash.txt

Wordlists that actually work

The single most useful wordlist is rockyou.txt: a ~14-million-entry leak of real user passwords. Ship with SecLists for more specialised lists:

git clone https://github.com/danielmiessler/SecLists.git

For slow KDFs (Office, ODF, RAR5), small high-quality lists work better than large ones — every extra iteration costs real time.

Rules & incremental mode

Rules transform a base wordlist (append digits, substitute letters, capitalise, etc.). Enable the built-in rule-set with:

john --wordlist=rockyou.txt --rules=KoreLogic hash.txt

Incremental mode ("brute force") generates candidates based on character-frequency statistics:

john --incremental hash.txt

Viewing results

Recovered passwords are written to ~/.john/john.pot. To display them:

john --show hash.txt