Take the 2-minute tour ×

I'm testing out John the Ripper (1.7.9 Jumbo 7) on a file containing MD5 hashes without any usernames. I've been experimenting with different rules and configurations – I am currently using a wordlist and I am applying the --rules=single command. As a result of running this command, I'm getting very good results with it, however, I can't seem to understand what is happening under the hood because of the following paragraph I found on Openwall's website:


Note that running this mode on many password files simultaneously may sometimes get more passwords cracked than it would if you ran it on the individual password files separately.

I'm confused by the statement "single crack" mode is much faster than wordlist mode. How come single mode is is faster than a simple dictionary attack if word mangling rules are being applied?

Any insight into what goes on in single mode cracking would be appreciated, since I can't seem to find much documentation other than that paragraph.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

The paragraph from JtR online documentation that you're adding to your question actually explains it pretty well.

Think of it as a dictionary mode (or WordList Mode), but one that builds the list of all words found in GECOS fields, making this dictionary rather small and uses a complete set of mangling rules JtR supports.

In contrast, the WordList Mode will have a much larger set of dictionary words to run through, but using a reduced set of mangling rules designed to finish very quickly on each dictionary entry. This limits the number of guesses on each candidate word.

So in short, Simple Mode will run a complete set of mangling rules on a short but highly relevant dictionary, where Wordlist Mode will use much longer dictionary, but reduce the mangling ruleset to complete faster.

This relevance (where the word list is compiled from), on top of bigger number of mangling runs per each candidate word, is the most likely candidate for your better results using the Single Mode.

share|improve this answer
Thank you for your comment - makes things clearer. –  Ian Muscat Jun 7 '13 at 22:21

It's using information it already has available.



From Linux Password Cracking

Found as a result from Google Search.

The typical format for the GECOS field is a comma-delimited list with this order:


  2. Building and room number or contact person

  3. Office telephone number

  4. Any other contact information (pager number, fax, etc.)

In most of the UNIX systems this information can be changed by normal users using the chfn command from the shell.

From Wikipedia

If the target is more advanced in their password creation, then single crack mode will likely not get a hit. If you have a dictionary of other passwords the user has used it will prove much more fruitful.

share|improve this answer

Your Answer


