Please note, this is not a technical question.

I am doing some research on Dictionary based password cracking that will hopefully be of use for optimisation.

So I was wondering how do most professional hackers use JTR.

Do you normally use it for just cracking one password at a time or do you use a short or long list of passwords? Also, how long would you leave it running before you gave up and tried another method?

Thanks

Ants

however many hashes i get from a box is how many i run john on, and will continue to run it on a non production machine until the engagement is close to reporting. Distributed jtr is my next goal to quicken the cracking process. jtr is vital to pentests, hope that helps

It depends on what you are trying to achieve. If you just want to prove a point JTR in single crack mode can reveal the weakest passwords in seconds and demonstrates the need for good password policy. I use longer runs when I want to leverage the passwords I find to get deeper.

Jimbob