# John the Ripper ![[Vaccine Write-up#^4s5zdz]] John can be used to crack [[NTLM]] hashes and [[#Cracking ZIP Passwords|ZIP archives]]. John requires the use of a wordlist. Some wordlists can be found here: ![[Cyber Security Tools#^1p1bli]] Kali comes preinstalled with wordlists which can be found in `/usr/share/wordlists`. Use `-w` to specify the wordlist and pass the file containing the hash without argument name: ```sh john -w=<path to word list> <path to file contaning the hash> ``` (it's important to use `=<path>` syntax for `-w`) John will store state in `~/.john` and will refuse to crack the same hashes twice with slightly cryptic error: `No password hashes left to crack (see FAQ)`. To see previously cracked hashes call John with the same file (and format) and with `--show` option. John will try to automatically detect the hash format of the file, but auto detect does not always work. It will often suggest the correct format to specify using `--format=<format>`. [[hashID]] can also be used to identify the hash format for John using `-j`. ## Cracking ZIP Passwords John comes with a utility called `zip2john` which will generate hashes from ZIP files. The output should be placed into a file which is then passed to John with format `--format=PKZIP`. ## Hack The Box Machines - [[Responder Write-up|Responder]] - [[Vaccine Write-up|Vaccine]]