I have a question about John the Ripper and it's incremental mode. As far as I know, the incremental mode is a brute-force mode, and it tries to get the password by systematic combining all possibilities for a password.

Depending on the password type it takes longer, that's clear. But let it be a md5 salted password hash. Is John automatically using the salt which is written in cleartext on /etc/shadow file to crack the password? or is it also guessing a valid salt?

  • 1
    I'm having trouble connecting your two paragraphs. Incremental mode and salting are independent of one another. Commented Oct 23, 2017 at 7:20

1 Answer 1


Most attacks on salted hashes assume that the salt directly accompanies the hash, usually directly in the hash format itself, or in a "hash:salt" format.

If you know the plaintext and you're trying to figure out the salt, you can use methods like the ones in my answer here.

If you know neither the plaintext nor the salt, that's trickier. MDXfind can generate short salts for you and also accept wordlists as plain text, so if it's a short static salt shared among many passwords, you can discover the salt.

But out of the box, most tools aren't going to try to guess both the plaintext and the salt simultaneously unless you do something to explicitly make that happen.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .