I am using jtr to perform an audit on our admin passwords. It's cracked a few which showed on the screen, however when I try and get them to show again with the --show command, it says it hasn't done any.
If I stop the scan and continue, it seems to know it's already cracked some.
Command to show;
$ ./john --show aff_pwds
0 password hashes cracked, 21 left
Command I run again;
$ ./john --incremental=All7 -format=raw-md5 --session=aff aff_pwds
Loaded 21 password hashes with no different salts (Raw MD5 [SSE2i 10x4x3])
Remaining 7 password hashes with no different salts
I can see the size of the john.pot file is a few k so it has things in there.
Any clue why it says I haven't done any?
I have tried john v 1.7.9, 1.7.7, 1.7.6 - same issue, so I must be doing something wrong....!
I have also tried to specify my own pot file with
--pot=foo
this gets bigger, and if I look in it I can see the passwords (but no usernames) but it just doesn't seem to be working for me.