John the Ripper

# Install Jumbo version (more hash types)
sudo apt install john

# Or build from source for latest
git clone https://github.com/openwall/john.git
cd john/src
./configure && make -s clean && make -sj4

# Auto-detect hash format and crack
john hashes.txt

# With wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# With rules
john --wordlist=rockyou.txt --rules hashes.txt
john --wordlist=rockyou.txt --rules=best64 hashes.txt

# Show cracked passwords
john hashes.txt --show

# Show with pot file
john --show --format=NT hashes.txt

# List available formats
john --list=formats
john --list=formats | grep -i ntlm
john --list=formats | grep -i sha

# Specify format explicitly
john --format=NT hashes.txt          # Windows NTLM
john --format=md5crypt hashes.txt    # Linux MD5 ($1$)
john --format=sha512crypt hashes.txt # Linux SHA512 ($6$)
john --format=bcrypt hashes.txt      # bcrypt ($2y$)
john --format=raw-md5 hashes.txt     # Plain MD5
john --format=raw-sha1 hashes.txt    # Plain SHA1
john --format=raw-sha256 hashes.txt  # Plain SHA256
john --format=krb5tgs hashes.txt     # Kerberoast
john --format=krb5asrep hashes.txt   # AS-REP Roast

# Combine passwd and shadow (required)
unshadow /etc/passwd /etc/shadow > combined.txt

# Crack it
john combined.txt --wordlist=rockyou.txt

# Check results
john combined.txt --show

# Dump NTLM from SAM (requires SYSTEM access, use secretsdump)
secretsdump.py -sam SAM -system SYSTEM LOCAL

# Crack NTLM hashes
john --format=NT ntlm_hashes.txt --wordlist=rockyou.txt

# Or pipe from secretsdump
secretsdump.py -sam SAM -system SYSTEM LOCAL | grep ":::" > ntlm.txt
john --format=NT ntlm.txt --wordlist=rockyou.txt

# Built-in rule sets
--rules                  # Default rules (mangle)
--rules=Wordlist         # Simple word mangling
--rules=best64           # 64 effective rules
--rules=NT               # Rules tuned for NT hashes
--rules=All              # All rules (slow, thorough)

# Custom rules in /etc/john/john.conf or ~/.john/john.conf
[List.Rules:MyRules]
cAz"[0-9]"              # Capitalize, append digit

# WPA/WPA2 (convert pcap first)
hcxpcapngtool -o hash.hc22000 capture.pcap
# John doesn't do hc22000, use hashcat for WPA

# Kerberoasting (from Impacket)
GetUserSPNs.py corp.local/user:pass -request -outputfile kerb_hashes.txt
john kerb_hashes.txt --format=krb5tgs --wordlist=rockyou.txt

# AS-REP Roasting
GetNPUsers.py corp.local/user:pass -request -format john -outputfile asrep.txt
john asrep.txt --wordlist=rockyou.txt

# Office documents
office2john encrypted.docx > office_hash.txt
john office_hash.txt --wordlist=rockyou.txt

# PDF password
pdf2john protected.pdf > pdf_hash.txt
john pdf_hash.txt --wordlist=rockyou.txt

# ZIP password
zip2john secret.zip > zip_hash.txt
john zip_hash.txt --wordlist=rockyou.txt

ls /usr/share/john/  # or /usr/lib/john/

# Common helpers
zip2john, rar2john, pdf2john, office2john
ssh2john, keepass2john, 7z2john
bitlocker2john, luks2john

# SSH key with passphrase
ssh2john id_rsa_encrypted > ssh_hash.txt
john ssh_hash.txt --wordlist=rockyou.txt

# Name a session (auto-saves progress)
john --session=mycrack --wordlist=rockyou.txt hashes.txt

# Restore a session
john --restore=mycrack

# Status of running john (press 'S' while running)
john --status=mycrack