Best Practices for John the Ripper

Choose wordlists strategically:

• Target-specific wordlists: Use domain-relevant terms
• Layered approach: Start small, then expand
• Combined wordlists: Merge multiple sources for better coverage
• Deduplicated lists: Remove duplicates to save time

# Combine and deduplicate wordlists
cat wordlist1.txt wordlist2.txt | sort -u > combined_wordlist.txt

# Create targeted wordlist from website content
cewl -d 2 -m 6 https://example.com > example_wordlist.txt

Optimize wordlists before use:

• Sort by probability: Put likely passwords first
• Remove invalid entries: Filter out entries that don't meet policy
• Optimize for target: Add domain-specific terms
• Precompute mangling: Generate common variations in advance

# Sort wordlist by length (shortest first)
cat wordlist.txt | awk '{print length, $0}' | sort -n | cut -d ' ' -f 2- > sorted_wordlist.txt

# Filter by length (8-20 characters)
cat wordlist.txt | grep -E '^.{8,20}$' > filtered_wordlist.txt

For MD5, SHA1, NTLM, etc.:

• Use GPU acceleration when available
• Apply extensive rule sets
• Consider larger wordlists
• Use incremental mode with broader character sets
• Implement mask attacks with larger keyspace

# Extensive rules with GPU acceleration
john --format=raw-md5-opencl --wordlist=wordlist.txt --rules=All hashes.txt

# Incremental mode with broad character set
john --format=raw-md5-opencl --incremental=All hashes.txt

For bcrypt, Argon2, PBKDF2, etc.:

• Focus on highly targeted wordlists
• Use minimal, high-probability rules
• Implement tight mask attacks
• Leverage distributed cracking
• Avoid incremental mode except for tiny keyspaces

# Targeted wordlist with minimal rules
john --format=bcrypt --wordlist=targeted_wordlist.txt --rules=Single hashes.txt

# Highly specific mask attack
john --format=bcrypt --mask='?u?l?l?l?l?d?d?d' hashes.txt

• Thread allocation: Set optimal thread count
• Process priority: Adjust for background operation
• Scheduling: Run intensive tasks during off-hours
• Thermal management: Monitor and manage heat

# Set optimal thread count (leaving 1 core free)
john --fork=$(nproc --ignore=1) hashes.txt

# Run with lower priority
nice -n 19 john hashes.txt

# Schedule with cron for off-hours
# 1 AM execution
# 0 1 * * * cd /path/to/john && ./john --restore=session_name

• Buffer size: Adjust for available RAM
• Swap usage: Minimize for performance
• File handling: Use memory-mapped files
• Hash loading: Optimize for large hash sets

# Limit memory usage for large hash sets
john --max-mem=2048 hashes.txt

# Use memory-mapped files for large wordlists
john --wordlist-memory-map=1 --wordlist=large_wordlist.txt hashes.txt

# Split large hash files for better memory management
split -l 100000 large_hashes.txt hash_part_

• Always obtain written authorization before password cracking
• Document scope and purpose of all cracking activities
• Maintain detailed logs of all commands and actions
• Establish clear boundaries for authorized testing
• Follow responsible disclosure procedures for findings

Sample authorization template:

I, [AUTHORIZED PERSON], authorize [TESTER] to conduct password
testing on [SPECIFIC SYSTEMS] from [START DATE] to [END DATE]
for the purpose of [PURPOSE].

Signed: _________________ Date: _________

• Encrypt all hash files when stored
• Securely delete temporary files after testing
• Limit access to cracked passwords
• Never store plaintext passwords unnecessarily
• Use secure channels for result transmission

# Encrypt hash files when not in use
gpg -c hashes.txt

# Securely delete files after use
shred -u hashes.txt cracked_passwords.txt

# Clear pot file after reporting
echo "" > john.pot

• ✅ Obtain proper authorization
• ✅ Identify hash types accurately
• ✅ Research target environment and policies
• ✅ Prepare optimized wordlists and rules
• ✅ Benchmark hardware capabilities
• ✅ Create attack strategy and timeline
• ✅ Set up secure environment for hash handling
• ✅ Document initial approach and methodology

• ✅ Use named sessions for all operations
• ✅ Implement regular checkpoints
• ✅ Monitor progress and performance
• ✅ Analyze interim results
• ✅ Adjust strategy based on findings
• ✅ Document all commands and configurations
• ✅ Secure intermediate results
• ✅ Maintain resource optimization

• ✅ Validate results for accuracy
• ✅ Analyze password patterns
• ✅ Document findings and statistics
• ✅ Securely communicate results
• ✅ Provide remediation recommendations
• ✅ Securely delete sensitive files
• ✅ Document lessons learned
• ✅ Update methodologies for future audits

• ✅ Update wordlists with new patterns
• ✅ Refine rules based on success rates
• ✅ Optimize hardware configurations
• ✅ Stay current with John updates
• ✅ Research new cracking techniques
• ✅ Build custom tools for specific needs
• ✅ Share knowledge (within ethical bounds)
• ✅ Maintain skills through regular practice