# John the Ripper — Password Security Auditing Tool

> A fast password cracker supporting hundreds of hash and cipher types, used by security teams to audit password strength and detect weak credentials.

## Install

Save as a script file and run:

# John the Ripper — Password Security Auditing Tool

## Quick Use
```bash
# Install on Debian/Ubuntu
sudo apt install john

# Install jumbo version from source
git clone https://github.com/openwall/john.git
cd john/src && ./configure && make -s clean && make -sj4

# Crack password hashes
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Show cracked passwords
john --show hashes.txt

# Auto-detect hash format
john hashes.txt
```

## Introduction
John the Ripper is one of the most widely used password security auditing tools, originally developed by Openwall. It combines multiple cracking modes (wordlist, incremental, rules-based) with support for hundreds of hash and cipher types. Security teams use it to verify password policy compliance and identify weak credentials before attackers do.

## What John the Ripper Does
- Cracks password hashes from operating systems (Unix, Windows NTLM, macOS), databases, and applications
- Supports over 300 hash formats in the community-enhanced jumbo version including bcrypt, SHA-crypt, and PBKDF2
- Applies intelligent wordlist rules to generate password variations from base dictionaries
- Uses incremental (brute-force) mode with configurable character sets and length ranges
- Leverages GPU acceleration via OpenCL for computationally intensive hash types

## Architecture Overview
John the Ripper is written in C with optional OpenCL kernels for GPU acceleration. The core engine manages a cracking session that coordinates multiple attack modes: single crack mode (uses login information), wordlist mode (dictionary with mangling rules), and incremental mode (systematic brute-force). The jumbo version adds a plugin-like format system where each hash type is a self-contained module implementing detection, parsing, and comparison functions. Session state is saved automatically for resumable cracking.

## Self-Hosting & Configuration
- Available in most Linux distribution repositories; the jumbo version provides the widest format support
- Build from source with `./configure && make` in the `src/` directory for the latest features
- Configuration lives in `john.conf` controlling rules, incremental character sets, and external modes
- GPU support requires OpenCL drivers installed for the target hardware
- Session management stores progress in `.rec` files for automatic resume after interruption

## Key Features
- Auto-detects hash formats from input files, reducing manual identification work
- Supports session save and restore for long-running jobs across reboots
- Rules engine transforms wordlist entries with over 100 built-in mangling operations
- Multi-CPU and multi-GPU parallelism for high-throughput auditing
- Processes common file formats directly: ZIP, RAR, PDF, SSH keys, KeePass databases, and office documents

## Comparison with Similar Tools
- **Hashcat** — GPU-focused cracker with generally faster GPU performance; John offers better CPU performance and broader format support out of the box
- **Hydra** — an online brute-forcer attacking live services; John works offline against extracted hashes
- **CrackStation** — online hash lookup service; John runs locally without sending hashes to third parties
- **Ophcrack** — specializes in Windows LM/NTLM hashes using rainbow tables; John covers far more hash types with multiple attack modes

## FAQ
**Q: What is the difference between John and the Jumbo version?**
A: The jumbo version is a community-enhanced build that adds support for hundreds of additional hash formats, GPU acceleration, and extra features beyond the original core release.

**Q: Can John the Ripper use GPU acceleration?**
A: Yes, the jumbo version supports OpenCL for GPU-accelerated cracking of supported hash types including bcrypt, SHA-512, and WPA/WPA2.

**Q: How do I extract hashes from files for John to crack?**
A: John includes helper scripts like `zip2john`, `rar2john`, `pdf2john`, and `ssh2john` that extract crackable hashes from encrypted files.

**Q: Is it legal to use John the Ripper?**
A: John is legal to possess and use on systems and data you own or have explicit written authorization to test. Unauthorized password cracking is illegal in most jurisdictions.

## Sources
- https://github.com/openwall/john
- https://www.openwall.com/john/

---
Source: https://tokrepo.com/en/workflows/asset-f4dfcbec
Author: Script Depot