Passwords

John the Ripper

CPU-oriented password recovery and format conversion for hashes collected under RoE.

Open sourcePost-exploitationInternal

What it is

John is the portable companion to hashcat: format conversion, CPU cracking, and jumbo formats that show up in application dumps. Same rules — vault only, client-approved hardware, report strength not trophies.

Reach for it when

Small hash sets, format conversion before hashcat, or when no GPU vault is available and the RoE still allows offline recovery.

Watch-outs

Same as hashcat: hashes are client secrets. No cloud crackers, no sharing wordlists that contain recovered live passwords. Stop when the report has enough examples to show the policy failure.

Typical invocation

john --wordlist=wordlists/corp.txt --format=Raw-MD5 hashes.txt

Authorized assessments only. Stay inside the rules of engagement.

Pin to a kit

Open an engagement first.

hashcat
GPU password recovery against hashes obtained under RoE, run only in the engagement vault.
Impacket
Python collection of Windows/AD protocol tools for authorized authentication and post-ex proof.
Responder
LLMNR/NBT-NS/mDNS analysis and poisoning for authorized internal identity assessments.