CmdID

CmdID / Commands

john

Password cracker. tldr-pages

On several platforms 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Crack password hashes

john path/to/hashes.txtIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Show passwords cracked

john --show path/to/hashes.txtIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Display users' cracked passwords by user identifier from multiple files

john --show --users=user_ids path/to/hashes1.txt path/to/hashes2.txt ...Identify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Crack password hashes, using a custom wordlist

john --wordlist=path/to/wordlist.txt path/to/hashes.txtIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

List available hash formats

john --list=formatsIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Crack password hashes, using a specific hash format

john --format=md5crypt path/to/hashes.txtIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Crack password hashes, enabling word mangling rules

john --rules path/to/hashes.txtIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Restore an interrupted cracking session from a state file, e.g. mycrack.rec

john --restore=path/to/mycrack.recIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

What detects it

Sigma process creation rules that name john
highLinux HackTool ExecutionNasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])