What are the first 3 characters of the hash? It should start with a $

What version of JTR are you running? That hash is for SHA 512 and I know older versions didn't support that. I'm not sure if there is a diff patch or if the newest version even supports SHA-512. Can you confirm?

I dont think it supports it but I could be wrong. I would probably just use an online service like http://crackstation.net/ this guy created a perl one http://blog.hacker.dk/2010/04/cracking-sha-256-and-sha-512-linuxunix-passwords/

According to this...

http://openwall.info/wiki/john/sample-hashes

...SHA-512 is supported in 1.7.6+ (as long as the underlying OS supports it <-- not sure what this means).  Or am I interpreting that wrong?

**UPDATE**
Reading this...


...from the hacker.dk link cd1zz posted, I think the section I put in parentheses above means the same thing..?

I had this problem too a while back. The error message: "Generic crypt (3) module: hash encoding string length x, type id y appears to be unsupported on this system" refers to the crypt function not being present on the system or JTR 1.7.6 and above was compiled without crypt being present on the system. I was unable to crack SHA-512 passwords with JTR 1.7.6 and above until I installed the crypt package on my Backtrack 4 system by typing: and then recompiling JTR with the crypt support. Once that was done I was able to successfully crack SHA-512 passwords:

root@bt:/tmp/john-1.7.8/run# cat sha512.txt
$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1

root@bt:/tmp/john-1.7.8/run# ./john sha512.txt
Loaded 1 password hash (generic crypt(3) [?/32])
No password hashes left to crack (see FAQ)
root@bt:/tmp/john-1.7.8/run# ./john --show sha512.txt
?:password
 
1 password hash cracked, 0 left

I usually apply the Jumbo patch to JTR which provides support for many more hash and cipher types, now includes Winzip password cracking which I want to play around with. The Jumbo patch is available for download here:
http://www.openwall.com/john/g/john-1.7.8-jumbo-2.diff.gz
Instructions on how to apply the Jumbo patch are available here: http://openwall.info/wiki/john/how-to-extract-tarballs-and-apply-patches

Passwords that are a SHA-512 hash, start with $6$ (86 characters)
Default password hashing method for Ubuntu Linux

SHA-256 hashes start with $5$ (43 Characters)
MD5 hashes start with $1$ (22 characters)
Blowfish hashes start with $2$ or $2a$ (depending on the variant used)