Ethical Hacking Academy · Lesson

John the Ripper

Versatile cracking.

John the Ripper is a free Ethical Hacking Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is John the Ripper?

John the Ripper (JtR) is a classic, highly versatile password cracker. The jumbo build supports hundreds of formats and bundles dozens of helper tools (the *2john family) for extracting hashes from files.

John's Cracking Modes

JtR has three core modes:

Single crack — uses login/GECOS info as hints
Wordlist — tries entries from a dictionary, optionally with rules
Incremental — smart brute force using character frequency

Single Crack Mode

Single mode is run first and is very effective: it mangles the username and account info (full name, home dir) into password guesses, catching people who base passwords on their own name.

john --single --format=sha512crypt hashes.txt

Wordlist Mode

Provide a dictionary with --wordlist and optionally apply mangling rules with --rules. Rule sets are defined in john.conf (e.g. --rules=Jumbo).

john --wordlist=rockyou.txt --rules hashes.txt

Incremental Mode

Incremental is JtR's brute force, but it is statistically guided — it tries likely character combinations first based on trained frequency data, making it smarter than naive brute force.

john --incremental hashes.txt

The 2john Tools

JtR jumbo can extract crackable hashes from many file types using helper scripts, then you crack the output.

zip2john secret.zip > zip.hash
ssh2john id_rsa > key.hash
office2john report.docx > doc.hash
john zip.hash

Cracking Linux Shadow

To crack /etc/shadow, first combine it with /etc/passwd using unshadow, then run John on the merged file.

unshadow /etc/passwd /etc/shadow > unshadowed.txt
john unshadowed.txt

Showing Results

Use --show to print cracked passwords. JtR stores progress in john.pot and john.rec, so you can interrupt and later resume.

john --show hashes.txt
john --restore

Specifying the Format

If JtR guesses the wrong format, force it with --format. List supported formats with --list=formats. A wrong format yields zero cracks even with the right password.

john --list=formats
john --format=raw-md5 hashes.txt

John vs Hashcat

JtR is CPU-strong, format-rich, and great for messy real-world files via its 2john tools. Hashcat is GPU-king for raw speed. Pentesters use both: JtR to extract and quick-crack, Hashcat for heavy GPU lifting.

Authorized Use

Like all cracking tools, use John only on hashes you are authorized to test. Extracting hashes from someone else's encrypted files or password stores without permission is illegal.

Quick Check

Test your John knowledge.

Recap

You learned John the Ripper:

Modes: single, wordlist (with --rules), incremental
*2john tools extract hashes from zip/ssh/office files
unshadow prepares Linux shadow hashes
--show and --restore manage results and sessions

Next: online vs offline attack strategies.

Frequently asked questions

Is the “John the Ripper” lesson free?

Yes — the full text of “John the Ripper” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “John the Ripper”?

Versatile cracking. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “John the Ripper” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Ethical Hacking Academy