John extractors

John jumbo’s *2john helpers convert supported encrypted files into password-verification records. The extractor, cracker and file-opening application are separate steps. Preserve an original copy, identify the format, then select the matching helper.

Basic workflow

file protected-file
# Example: a supported KeePass database
keepass2john Database.kdbx > database.john
john --wordlist=/usr/share/wordlists/rockyou.txt database.john
john --show database.john

Inspect extraction errors on stderr. An empty output file or an unsupported-format warning is not a successful extraction. Script names and paths vary; common locations are /usr/share/john/ and a jumbo checkout’s run/ directory.

Select by format, not extension

Consult the installed cracker’s supported formats before choosing a mode. For SSH/PFX, the extension alone cannot establish that one hashcat mode is correct.

The supplied report runs office2john on a file labelled .one and obtains an Office record. That does not establish general OneNote support: inspect the actual file container and the installed extractor before using it. A renamed Office document and a native OneNote section are not interchangeable.

See AxCrypt and Ansible Vault for complete extract, crack and open workflows.

John labels are not always hashcat-ready

Extractors can include a filename label and extra trailing fields. hashcat --username ignores the initial username/label field; it does not translate every John-specific record into a compatible hashcat representation.

# Example: an Office 2013 record that matches hashcat's 9600 format
python3 /usr/share/john/office2john.py review.xlsx > review.john
hashcat --identify --username review.john
hashcat -m 9600 --username review.john /usr/share/wordlists/rockyou.txt
hashcat -m 9600 --username --show review.john

Use 9600 only after identifying Office 2013. Identification can return multiple candidate modes; compare the record with the documented examples. Do not assume automatic detection will always pick one, or strip arbitrary colon-separated fields from formats that use them internally.

Encrypted SSH key example

python3 /usr/share/john/ssh2john.py id_rsa > ssh.john
john --wordlist=/usr/share/wordlists/rockyou.txt ssh.john
john --show ssh.john

An unencrypted key has no passphrase to crack. After recovery, verify the key locally with ssh-keygen -y -f id_rsa; this proves the passphrase opens the key, not that a target accepts the key for login.

Success and next step

Success: the recovered password opens the original container with its normal application. A potfile hit alone is not the final validation. For a database with a keyfile, retain both components and check the exact combination.

Recent John jumbo source includes KDBX4/Argon2 extraction support, but older packaged builds may not. Successful extraction still does not mean your hashcat build supports that KDF. Prefer a compatible current John format rather than forcing every .kdbx into 13400.

Record the original filename, extractor/version, output prefix, selected format/mode and verification result. Redact recovered secrets from the report.

Keep an extractor manifest

umask 077
mkdir -p evidence/extractors
file review.xlsx > evidence/extractors/file-type.txt
sha256sum review.xlsx > evidence/extractors/input.sha256
python3 /usr/share/john/office2john.py review.xlsx \
  > evidence/extractors/review.john 2> evidence/extractors/extract-errors.txt
john --list=formats

Use a jumbo build. A helper script found on disk does not guarantee the installed cracker includes the corresponding format.

Choose a session and candidate strategy

john --session=lab-office --wordlist=lab-candidates.txt evidence/extractors/review.john
john --status=lab-office
# Resume only after interruption of the original run
john --restore=lab-office
john --show evidence/extractors/review.john

Start with an agreed candidate set based on the file’s context. Rules mutate those candidates; they cannot fix a wrong extractor or unsupported KDF. Keep separate sessions for unrelated formats so a resume file is associated with the correct source.

Common record traps

Validation examples after recovery

# SSH: prompts locally for the recovered key passphrase
ssh-keygen -y -f id_rsa > evidence/extractors/public-key.txt

# Ansible: reads plaintext without replacing the encrypted file
ansible-vault view encrypted-value.vault --ask-vault-pass

# ZIP: tests archive integrity and may prompt for the member password
unzip -t encrypted.zip

Use the normal compatible reader for Office, KeePass and AxCrypt. An SSH public-key export proves key decryption; an accepted SSH login is a separate permission check. Archive testing can reveal that only some members are encrypted.

Know when to stop

If the helper reports an unsupported format, inspect its supported headers and use a compatible current tool. If John loads the correct record but exhausts the candidate list, report that result accurately. If the file opens but enclosed credentials are stale, the passphrase recovery is still valid; credential reuse has not been demonstrated.

See Also

• hashcat
• John the Ripper
• kpcli & keepassxc-cli

Sources

• John jumbo
• keepass2john source
• hashcat example hashes and mode names