John the Ripper Tutorial: Beginner's Password Cracking

Weak passwords remain one of the most consistently exploited weaknesses in any organization's security posture, and understanding how attackers actually crack passwords is essential for building defenses that hold up under real pressure. John the Ripper is one of the most widely used password cracking tools in professional security testing, valued for its speed, flexibility, and support for an enormous range of hash formats.

This guide walks through installing John the Ripper, understanding hash formats, running your first cracking session, and using more advanced techniques like rule-based attacks and mask attacks, all within the context of authorized security testing. SageFox Cybersecurity uses these same techniques as part of internal password audits and authorized penetration testing engagements, and this tutorial reflects the practical workflow we rely on in the field.

What Is John the Ripper and When Should You Use It

A Brief Overview of the Tool

John the Ripper, often shortened to John, is an open source password cracking tool originally designed to detect weak Unix passwords. It has since expanded to support hundreds of hash types, including Windows NTLM, Linux shadow file hashes, and application-specific formats used by databases, archives, and document formats.

Legal and Ethical Use Only

Password cracking should only ever be performed against systems and accounts you own or have explicit written authorization to test. Running these techniques against systems without permission is illegal in most jurisdictions and violates the basic principles of responsible security testing. If your organization needs a structured, authorized password audit, SageFox Cybersecurity's assessment team at www.sagefoxusa.com can help design and run this safely within a defined scope.

Installing John the Ripper

Installing on Linux

Most Linux distributions offer John the Ripper directly through their package manager, though the jumbo community edition offers significantly more hash format support:

bash

sudo apt update
sudo apt install john -y
john --version

For the jumbo edition with expanded format support, building from source is recommended:

bash

git clone https://github.com/openwall/john.git
cd john/src
./configure && make -s clean && make -sj4

Installing on macOS and Windows

On macOS, John the Ripper is available through Homebrew:

bash

brew install john

On Windows, the jumbo build can be downloaded as a precompiled binary from the official Openwall repository and run directly from the command line without additional compilation steps.

Understanding Password Hashes Before You Start

Why Hash Format Matters

Before attempting to crack anything, you need to identify what type of hash you are working with. John supports formats ranging from simple MD5 to complex, salted formats used in modern systems. Attempting to crack a hash with the wrong format specified will either fail outright or silently produce incorrect results.

Identifying an unknown hash format:

bash

hashid '$6$rounds=5000$saltstring$hashvalue'

This example format, prefixed with $6$, indicates a SHA-512 crypt hash commonly found in modern Linux shadow files.

Extracting Hashes from a Linux System

On a Linux system you own or have authorization to test, combining the passwd and shadow files into a crackable format:

bash

sudo unshadow /etc/passwd /etc/shadow > combined_hashes.txt

Extracting Windows Hashes

On a Windows system, NTLM hashes can be extracted from the SAM database for authorized local testing using a registry hive dump, then processed for cracking:

bash

samdump2 SYSTEM SAM > windows_hashes.txt

Always ensure these extraction techniques are performed only within an authorized testing scope, ideally on an isolated lab machine when you are first learning the tool.

Running Your First Cracking Session

Basic Dictionary Attack

The simplest and often most effective first approach is a dictionary attack using a common wordlist. Kali Linux ships with rockyou.txt, a widely used wordlist derived from a historical breach dataset, commonly used for authorized testing and training:

bash

john --wordlist=/usr/share/wordlists/rockyou.txt combined_hashes.txt

Viewing Cracked Passwords

Once John has processed the hash file, cracked passwords can be viewed at any time without needing to rerun the attack:

bash

john --show combined_hashes.txt

Understanding the Cracking Session Output

While running, John displays a live status showing guesses per second and estimated progress. Pressing any key during a session shows a status update without interrupting the run, which is useful for long sessions against larger hash sets.

Improving Your Cracking Success Rate

Using Rule-Based Attacks

Real users rarely choose passwords straight out of a dictionary. They append numbers, capitalize letters, or substitute characters. John's rule engine simulates these common modifications automatically:

bash

john --wordlist=/usr/share/wordlists/rockyou.txt --rules=Jumbo combined_hashes.txt

This single flag can dramatically increase crack rates against real-world password sets compared to a raw wordlist alone, since it accounts for common human password patterns.

Mask Attacks for Known Password Patterns

When you know something about the password structure, such as a company-mandated length or a known suffix pattern, a mask attack targets that structure directly rather than testing every possible combination:

bash

john --mask='?u?l?l?l?l?l?d?d' combined_hashes.txt

In this example, the mask targets passwords starting with one uppercase letter, followed by five lowercase letters, followed by two digits, a pattern surprisingly common in corporate password policies that only enforce basic complexity rules.

Incremental Mode for Brute Force Attacks

For shorter or lower-complexity hashes, incremental mode performs a true brute force attack across a defined character set:

bash

john --incremental=Alnum --max-length=8 combined_hashes.txt

This mode is significantly slower than dictionary or mask attacks and should generally be reserved for auditing short, legacy password policies rather than modern, longer credential requirements.

Auditing Password Policy Strength in Your Organization

Running a Controlled Internal Password Audit

Beyond simulated attacks, John the Ripper is frequently used defensively to audit an organization's own password policy effectiveness. Extracting hashes from a test Active Directory environment and running a rule-based attack reveals how many accounts would fall to a realistic dictionary and rule combination, providing hard data on policy effectiveness rather than assumptions.

bash

john --wordlist=/usr/share/wordlists/rockyou.txt --rules=Jumbo --format=nt ad_hashes.txt

Measuring and Reporting Results

Tracking the percentage of accounts cracked within a defined time window, for example one hour of GPU-accelerated cracking, gives leadership a concrete, defensible metric for password policy risk rather than a vague statement about weak passwords. Organizations that have never run this kind of internal audit are often surprised by how many accounts fall within minutes using nothing more than a public wordlist and basic rules.

Speeding Up Cracking with GPU Acceleration

Why CPU Cracking Has Limits

Standard John the Ripper sessions run on CPU, which is sufficient for smaller hash sets but slow against larger password audits. For GPU acceleration, John's jumbo build supports OpenCL formats for compatible hash types:

bash

john --format=nt-opencl --wordlist=/usr/share/wordlists/rockyou.txt --rules=Jumbo combined_hashes.txt

Checking Available OpenCL Devices

Before running a GPU-accelerated session, confirm your hardware is properly detected:

bash

john --list=opencl-devices

GPU acceleration can improve cracking speed by an order of magnitude or more depending on hardware, which matters significantly when auditing large Active Directory environments with thousands of accounts.

Common Mistakes Beginners Make

Using the Wrong Hash Format

Specifying an incorrect format is the single most common reason a cracking session fails silently or produces no results. Always confirm the format using hashid or by inspecting the hash prefix before launching a session.

Relying Only on a Single Wordlist

A single generic wordlist without rules will miss a significant portion of real-world passwords. Combining a solid wordlist with rule-based mangling consistently outperforms a larger wordlist used alone.

Skipping Authorization

Even in a home lab, it is worth building the habit of documenting scope and authorization for every cracking exercise. This discipline carries directly into professional engagements where scope violations carry real legal and contractual consequences. If you are building this skill set toward professional password auditing work, SageFox Cybersecurity's team at www.sagefoxusa.com can offer guidance on structuring these engagements properly from day one.

Wrapping Up

John the Ripper remains one of the most practical tools for understanding real password security, whether you are learning offensive security fundamentals or auditing your own organization's password policy effectiveness. Starting with basic dictionary attacks, then layering in rules, masks, and GPU acceleration, mirrors the actual workflow professional testers use, and understanding this process makes it far easier to explain to leadership exactly why password policy and multi factor authentication matter as much as they do.

If your organization wants a professional, authorized password audit rather than a self-guided exercise, SageFox Cybersecurity can help design and execute that assessment safely. Visit www.sagefoxusa.com to learn more about our password security and penetration testing services.