This sheet was originally based on john-1.7.8-jumbo-5. Added information on how to munge the hashes into a format supported by john.Added reminders on how hashes can be collected.For each example hash I’ve stated whether it will be automatically recognised by john, or whether you’ll have to use the “–format” option (in which case I’ve included which –format option you need).Provided examples of what your hashes.txt file might look like (though I’m sure other variations are supported that aren’t covered here yet).Copied example hashes out of the source code for most supported hash types.I thought it might be helpful to compile a cheat sheet to reduce the amount of time I spend grepping and googling. These problems can all be sorted with a bit of googling or grepping through the john source code.

Sometimes I gain access to a system, but can’t recall how to recover the password hashes for that particular application / OS.

This is inevitable because some hashes look identical.

John will occasionally recognise your hashes as the wrong type (e.g.

The hashes you collect on a pentest sometimes need munging into a different format… but what’s the format john is expecting?.

Sometimes I stumble across hashes on a pentest, but don’t recognise the format, don’t know if it’s supported by john, or whether there are multiple “–format” options I should try.

These are not problems with the tool itself, but inherent problems with pentesting and password cracking in general. I’ve encountered the following problems using John the Ripper. There is plenty of documentation about its command line options. John the Ripper is a favourite password cracking tool of many pentesters.

Lm cracking