Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using jtr to perform an audit on our admin passwords. It's cracked a few which showed on the screen, however when I try and get them to show again with the --show command, it says it hasn't done any.

If I stop the scan and continue, it seems to know it's already cracked some.

Command to show;

$ ./john --show aff_pwds 
0 password hashes cracked, 21 left

Command I run again;

$ ./john --incremental=All7 -format=raw-md5 --session=aff aff_pwds
Loaded 21 password hashes with no different salts (Raw MD5 [SSE2i 10x4x3])
Remaining 7 password hashes with no different salts

I can see the size of the john.pot file is a few k so it has things in there.

Any clue why it says I haven't done any?

I have tried john v 1.7.9, 1.7.7, 1.7.6 - same issue, so I must be doing something wrong....!

I have also tried to specify my own pot file with


this gets bigger, and if I look in it I can see the passwords (but no usernames) but it just doesn't seem to be working for me.

share|improve this question

You must log in to answer this question.

Browse other questions tagged .