john
john — John the Ripper — is the Swiss Army knife of offline password cracking.
It autodetects a huge range of hash formats, cracks them with wordlists, rules,
and brute force, and is famously good at the messy real-world job of figuring out
what kind of hash you even have. It also ships a small army of *2john helper
scripts that extract crackable hashes out of other things — encrypted ZIPs, PDFs,
KeePass databases, SSH keys, and dozens more — so you can feed almost anything
into it.
It lives at Security → Password Attacks → john. In the menu it’s a
single entry — the ~130 *2john converters it ships aren’t listed individually,
but they’re all on your PATH (zip2john, ssh2john, keepass2john, and so on).
The help it prints
Show the full output
John the Ripper 1.9.0-jumbo-1 MPI + OMP [linux-gnu 64-bit x86_64 AVX AC]
Copyright (c) 1996-2019 by Solar Designer and others
Homepage: http://www.openwall.com/john/
Usage: john [OPTIONS] [PASSWORD-FILES]
--single[=SECTION[,..]] "single crack" mode, using default or named rules
--single=:rule[,..] same, using "immediate" rule(s)
--wordlist[=FILE] --stdin wordlist mode, read words from FILE or stdin
--pipe like --stdin, but bulk reads, and allows rules
--loopback[=FILE] like --wordlist, but extract words from a .pot file
--dupe-suppression suppress all dupes in wordlist (and force preload)
--prince[=FILE] PRINCE mode, read words from FILE
--encoding=NAME input encoding (eg. UTF-8, ISO-8859-1). See also
doc/ENCODINGS and --list=hidden-options.
--rules[=SECTION[,..]] enable word mangling rules (for wordlist or PRINCE
modes), using default or named rules
--rules=:rule[;..]] same, using "immediate" rule(s)
--rules-stack=SECTION[,..] stacked rules, applied after regular rules or to
modes that otherwise don't support rules
--rules-stack=:rule[;..] same, using "immediate" rule(s)
--incremental[=MODE] "incremental" mode [using section MODE]
--mask[=MASK] mask mode using MASK (or default from john.conf)
--markov[=OPTIONS] "Markov" mode (see doc/MARKOV)
--external=MODE external mode or word filter
--subsets[=CHARSET] "subsets" mode (see doc/SUBSETS)
--stdout[=LENGTH] just output candidate passwords [cut at LENGTH]
--restore[=NAME] restore an interrupted session [called NAME]
--session=NAME give a new session the NAME
--status[=NAME] print status of a session [called NAME]
--make-charset=FILE make a charset file. It will be overwritten
--show[=left] show cracked passwords [if =left, then uncracked]
--test[=TIME] run tests and benchmarks for TIME seconds each
--users=[-]LOGIN|UID[,..] [do not] load this (these) user(s) only
--groups=[-]GID[,..] load users [not] of this (these) group(s) only
--shells=[-]SHELL[,..] load users with[out] this (these) shell(s) only
--salts=[-]COUNT[:MAX] load salts with[out] COUNT [to MAX] hashes
--costs=[-]C[:M][,...] load salts with[out] cost value Cn [to Mn]. For
tunable cost parameters, see doc/OPTIONS
--save-memory=LEVEL enable memory saving, at LEVEL 1..3
--node=MIN[-MAX]/TOTAL this node's number range out of TOTAL count
--fork=N fork N processes
--pot=NAME pot file to use
--list=WHAT list capabilities, see --list=help or doc/OPTIONS
--devices=N[,..] set OpenCL device(s) (see --list=opencl-devices)
--format=NAME force hash of type NAME. The supported formats can
be seen with --list=formats and --list=subformatsExamples
# Crack a hash file, letting john pick the format
john hashes.txt
# Use a wordlist with mangling rules
john --wordlist=/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt --rules hashes.txt
# Force a specific format
john --format=raw-md5 hashes.txt
# Extract a hash from an encrypted zip, then crack it
zip2john secret.zip > zip.hash
john --wordlist=/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt zip.hash
# Show what's already been cracked
john --show hashes.txt