Learned John the Ripper by cracking MD5, SHA1, SHA256, Whirlpool, NTLM hashes, plus ZIP files, RAR archives, and SSH keys. Everything fell to rockyou.txt. If your password is in a wordlist, it’s not a password — it’s a suggestion.

The Setup

John the Ripper = password cracking tool that’s been around since 1996.

What it does:

  • Takes a hash (scrambled password)
  • Tries millions of passwords from wordlists
  • Compares each guess to the hash
  • Tells you when it finds a match

This room covered:

  • Basic hash cracking (MD5, SHA1, SHA256, Whirlpool)
  • Windows NTLM hashes
  • Linux /etc/shadow hashes
  • Password-protected ZIPs
  • Password-protected RARs
  • SSH private key passphrases

The Three Modes (And Why You Only Need Two)

John has three cracking modes. Here’s what they actually do:

1. Single Crack Mode

john --single --format=raw-md5 hash.txt

What it does: Uses the username to generate password guesses.

Example: If the username is “joker”, it tries:

  • joker
  • Joker
  • JOKER
  • joker123
  • Joker!
  • j0ker
  • joker1

Why it works: People use their own name/username in passwords way more than they should.

Speed: FAST — seconds to minutes

In the room: Cracked “Jok3r” instantly because the username was “Joker”

2. Wordlist Mode (The Real One)

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

What it does: Tries every password from a wordlist file.

Rockyou.txt: 14 million passwords from a real 2009 data breach. If your password is in this list, it’s already compromised.

Speed: FAST for weak passwords (seconds), SLOW for strong ones (never finishes)

In the room: Cracked literally everything with rockyou.txt

3. Incremental Mode (Brute Force)

john --incremental hash.tx

What it does: Tries every possible character combination. a, b, c, aa, ab, ac… forever.

Speed: EXTREMELY SLOW

Reality: You’ll never use this. If wordlist mode didn’t crack it, the password is probably strong enough that brute force would take years.

In the room: Never needed it

Hash Types and Formats

John can crack basically any hash type. Here’s what I encountered:

Basic Hashes

Identify the hash type:

python3 hash-id.py
# OR
john hash.txt

John auto-detects most formats, but sometimes you need to specify:

john --format=raw-md5 hash.txt        # MD5
john --format=raw-sha1 hash.txt       # SHA1
john --format=raw-sha256 hash.txt     # SHA256
john --format=whirlpool hash.txt      # Whirlpool

Results from the room:

  • MD5 hash → cracked to “biscuit”
  • SHA1 hash → cracked to “kangeroo”
  • SHA256 hash → cracked to “microphone”
  • Whirlpool hash → cracked to “colossal”

All fell in seconds with rockyou.txt.

Windows NTLM Hashes

john --format=nt hash.txt --wordlist=rockyou.txt

Windows stores passwords as NTLM hashes. If you can dump these (with Mimikatz or similar), John cracks them.

Room result: “mushroom”

Linux /etc/shadow Hashes

Linux stores password hashes in /etc/shadow, but John needs context from /etc/passwd too.

Why?

  • /etc/passwd = usernames and user info (world-readable)
  • /etc/shadow = actual password hashes (root only)

Combine them with unshadow:

unshadow passwd.txt shadow.txt > unshadowed.txt
john unshadowed.txt --wordlist=rockyou.txt

This gives John the username, which helps with Single mode and understanding the hash format.

Room result: Root password was “1234” (lol)

Cracking Files (Not Just Hashes)

John has helper tools to extract hashes from password-protected files:

ZIP Files

zip2john secure.zip > zip_hash.txt
john zip_hash.txt --wordlist=rockyou.txt

Room result: Password was “pass123”

RAR Archives

rar2john secure.rar > rar_hash.txt
john rar_hash.txt --wordlist=rockyou.txt

Room result: Password was “password” (seriously)

SSH Private Keys

ssh2john id_rsa > ssh_hash.txt
john ssh_hash.txt --wordlist=rockyou.txt

SSH private keys can have passphrases. If someone steals your private key but it’s passphrase-protected, John can crack that too.

Room result: Passphrase was “mango”

Pattern here? All these passwords (pass123, password, mango) are in rockyou.txt. That’s the point.

What I Actually Learned

1. Most Passwords Are Terrible

Every single hash in this room fell to rockyou.txt. Yes, it’s a beginner room with intentionally weak passwords, but here’s the reality:

Real breach statistics:

  • “123456” — used by millions
  • “password” — used by millions
  • “qwerty” — used by millions
  • Variations of these — used by millions more

If your password is:

  • A dictionary word
  • A common phrase
  • Your name + numbers
  • Already in a data breach

It will crack in seconds.

2. Hash Type Doesn’t Matter for Weak Passwords

The room had me crack:

  • MD5 (considered weak)
  • SHA256 (considered strong)
  • Whirlpool (super strong)

All fell in seconds.

Why? Because “biscuit” is a terrible password whether you hash it with MD5 or SHA256. The hash algorithm doesn’t save you from a weak password.

3. Single Mode is Underrated

john --single hash.txt

Single mode uses the username to guess passwords. It cracked “Jok3r” from the username “Joker” instantly.

Why this matters in real attacks:

  • Corporate accounts often use FirstnameLastname format
  • People include their company name in passwords
  • Users reuse parts of their username

Before running a massive wordlist, try Single mode first. It’s fast and catches the low-hanging fruit.

4. File Protection is Password Protection

ZIP files, RAR archives, SSH keys — they’re all just password hashes in disguise.

The workflow:

  1. Extract the hash with zip2john / rar2john / ssh2john
  2. Crack it like any other hash
  3. Use the password to open the file

Real-world scenario: You find an encrypted backup ZIP on a compromised server. If it’s protected with “backup2024”, you’re in.

The One Defense That Actually Works

After cracking all these passwords, here’s what would’ve stopped me:

Long, random, unique passwords.

Examples of uncrackable passwords:

K7$mP2@qX9#vL4wN5&tR8
correct-horse-battery-staple-purple-elephant
mJ9#pL2@vK8$nR4&wQ7

Why these work:

  • Not in any wordlist
  • Too long for brute force
  • Random enough that rules won’t generate them

Use a password manager:

  • Bitwarden (free, open source)
  • 1Password
  • KeePass

Let it generate random passwords. You only need to remember one master password.

Practical Commands Reference

Basic cracking:

# Let John auto-detect
john hash.txt --wordlist=rockyou.txt
# Specify format
john --format=raw-md5 hash.txt --wordlist=rockyou.txt
# Try single mode first
john --single hash.txt
# Show cracked passwords
john --show hash.txt

File cracking:

# ZIP
zip2john file.zip > hash.txt
john hash.txt --wordlist=rockyou.txt
# RAR
rar2john file.rar > hash.txt
john hash.txt --wordlist=rockyou.txt
# SSH key
ssh2john id_rsa > hash.txt
john hash.txt --wordlist=rockyou.txt

Linux shadow:

unshadow passwd.txt shadow.txt > combined.txt
john combined.txt --wordlist=rockyou.txt

Windows NTLM:

john --format=nt hash.txt --wordlist=rockyou.txt

Custom Rules (Advanced)

John supports custom rules to mutate wordlist entries:

Common rules:

  • c = Capitalize first letter (password → Password)
  • u = Uppercase all (password → PASSWORD)
  • $[0-9] = Append number (password → password1)
  • ^[0-9] = Prepend number (password → 1password)
  • Az"[A-Z]" = Append capital letter (password → passwordA)

Using custom rules:

john --wordlist=rockyou.txt --rules=THMRules hash.txt

Reality: Rockyou.txt already has so many variations that custom rules often aren’t needed for weak passwords.

Real-World Application

If I were pentesting and found password hashes:

Step 1: Try Single mode (30 seconds)

john --single hashes.txt

Catches username-based passwords instantly.

Step 2: Try rockyou.txt (5–10 minutes)

john --wordlist=rockyou.txt hashes.txt

Catches weak passwords.

Step 3: Check results

john --show hashes.txt

Step 4: Try larger wordlists if needed

john --wordlist=/usr/share/wordlists/seclists/Passwords/probable-v2-top12000.txt hashes.txt

Step 5: Give up on strong passwords

If it hasn’t cracked by now, the password is probably actually good. Move on to other attack vectors.

What I wouldn’t do: Run incremental mode for days. That’s a waste of time. Strong passwords exist.

The Uncomfortable Truth

This room was easy because the passwords were weak. But here’s the thing:

Real data breaches show the same pattern.

When researchers analyze leaked password databases:

  • 50% of passwords are in common wordlists
  • 10% are variations of common passwords
  • Only 40% are actually unique/strong

Translation: Half of all passwords crack instantly with tools like John.

Your takeaway:

  • Use a password manager
  • Generate random passwords
  • Enable 2FA everywhere
  • Assume password-only authentication is broken

Final Thoughts

John the Ripper is stupid simple:

  1. Feed it a hash
  2. Feed it a wordlist
  3. Wait for results

The tool isn’t complicated. What’s complicated is understanding that password security is fundamentally broken because humans are terrible at creating random strings.

Key lessons:

  • Single mode for username-based guesses
  • Wordlist mode for everything else
  • Incremental mode is useless for real work
  • File passwords are just hashes in disguise
  • Most passwords crack in seconds
  • Only random, long, unique passwords survive

If you use “Password123!” anywhere, change it. Now.

Related posts:

Tags: #TryHackMe #JohnTheRipper #PasswordCracking #Hashing #Pentesting #OffensiveSecurity

Use strong passwords. Use 2FA. Use a password manager. Seriously.