Enabling bash completion for John the Ripper To enable bash completion for john and unique for all users, just use make bash-completion You need administrative privileges for this make target, because the script john.bash_completion will be copied to /etc/bash_completion.d/. To enable bash completion just for your user, it is enough to source the bash completion script in your ~/.bashrc To to this, add the following line to your ~/.bashrc file: . /john.bash_completion To just enable bash completion for john and unique temporarily, just execute the following command in your current session: $ . /john.bash_completion (The $ just indicates the command prompt, it is not part of the command.) If you build different john versions, say a default (non-omp) version named john, and an omp-enabled version named john-omp, you can enable the same bash completion logic for the john-omp binary by adding this line to your ~./bashrc file: complete -F _john john-omp Features The bash completion for unique does nothing for a non-jumbo build. For a jumbo build, it supports completion for the command line options which only exist for the jumbo version. The bash completion for john supports file name completion for password (hash) files. It also supports completion for the command line options. Abbreviated command line options are completed to their long form, with two leading '-' characters. For options with a mandatory value, the completion also adds the '=' character. Examples $ ./john -w[tab] results in completion to $ ./john --wordlist= $ ./john --wordlist=[tab][tab] will list all file names in the current directory as possible completions. $ ./john -fo[tab] $ john --f[tab] for an official, non-jumbo john version 1.7.8 results in completion to $ john --format= $ john --format=[tab][tab] for the official john version 1.7.8 will list all the supported formats as possible completions: AFS BF BSDI crypt DES LM MD5 $ john --format=D[tab] will be completed to $ john --format=DES For a jumbo version, e.g. 1.7.9-jumbo-5, $ ./john -f[tab] will become $ ./john --f The reason is that --format is not the only option starting with --f. For this version, $ ./john --f[tab][tab] will list all possible completions like this: $ ./john --f --field-separator-char= --fix-state-delay= --format= $ ./john --fo[tab] will become $ ./john --format= $ ./john --format=[tab]tab] will list all available formats of this version as possible completions: $ ./john --format= afs lm netntlm raw-sha bf lotus5 netntlmv2 raw-sha1 bfegg md4-gen nsldap raw-sha224 bsdi md5 nt raw-sha256 crc32 md5ns nt2 raw-sha384 crypt mediawiki oracle raw-sha512 des mscash oracle11 salted-sha1 dmd5 mscash2 pdf sapb dominosec mschapv2 phpass-md5 sapg dummy mskrb5 phps sha1-gen dynamic mssql pix-md5 ssh epi mssql05 pkzip sybasease hdaa mysql po trip hmac-md5 mysql-fast rar xsha hmailserver mysql-sha1 raw-md4 xsha512 ipb2 nethalflm raw-md5 zip krb4 netlm raw-md5thick krb5 netlmv2 raw-md5u $ ./john --format=a[tab] will become $ ./john --format=afs To get possible completions for values of an option, it is not required to use the full name of that option. Instead, it is possible to start the option name with just one '-' character instead of two. It is also possible to use the ':' character (colon) instead of the '=' character (equal sign) to separate option name and value, because john also supports this character as a separator between option and value. (The completion logic for options with a colon as a separator depends on the value of the environment variable COMP_WORDBREAKS. The default logic explained here assumes that COMP_WORDBREAKS contains the colon. The logic used when COMP_WORDBREAKS doen't contain the colon is mentioned in the last chapter ("Config variables") of this document.) Furthermore, the option name can be abbreviated, provided it is not ambiguous. E.g., for an official, non-jumbo john version 1.7.8 bash completion will list all supported hash formats as possible completions, if the [tab] key is pressed twice at the end of the command line: $ john -f: $ john -f= $ john --f: $ john --f= $ john -fo: $ john -fo= $ john --fo: $ john --fo= ... For a jumbo build, the first 4 examples will not work, because the option name is ambiguous. A jumbo version also has the options --field-separator-char= and --fix-state-delay=, so at least the first two letters of the option name must be specified. If future john versions get new options with names beginning with --fo, even more letters need to be specified. Similarly, for an official john version 1.7.8 build, $ john -f:c[tab] would become $ john -f:crypt And $ john -fo=D[tab] will become $ john -fo=DES That means, only the value will be completed, the option name and the separator between option name and value remain unchanged. This is OK, because john also supports using an abbreviated option name, as long as it is not ambiguous. If the john version supports the --list=hidden-options option, then the hidden options (not mentioned in john's usage output) are also considered as valid completions for option names. Special completion for certain options --format= As mentioned above in the general description of the completion logic, the completion logic considers all the supported formats, as listed in john's usage output. For the jumbo version, there is a special handling for the dynamic formats (see the files DYNAMIC and DYNAMIC_SCRIPTING for more information). $ ./john --format=dy[tab] will become $ ./john --format=dynamic $ ./john --format=dynamic[tab] will become $ ./john --format=dynamic_ $ ./john --format=dynamic_[tab][tab] will list all available dynamic formats, like this: $ ./john --format=dynamic_ dynamic_0 dynamic_1006 dynamic_15 dynamic_22 dynamic_3 dynamic_1 dynamic_1007 dynamic_16 dynamic_23 dynamic_4 dynamic_10 dynamic_1008 dynamic_17 dynamic_24 dynamic_5 dynamic_1001 dynamic_1009 dynamic_18 dynamic_25 dynamic_6 dynamic_1002 dynamic_11 dynamic_19 dynamic_26 dynamic_7 dynamic_1003 dynamic_12 dynamic_2 dynamic_27 dynamic_8 dynamic_1004 dynamic_13 dynamic_20 dynamic_28 dynamic_9 dynamic_1005 dynamic_14 dynamic_21 dynamic_29 The list of dynamic formats available can also be listed using this command: $ ./john --subformat=LIST (Jumbo versions only) --rules and --single For official john version of john which don't support optional values for --rules and --single, completion will just add a trailing space at the end of the command line, so that the user can continue typing the next word (e.g., an option or file name) on the command line. Jumbo versions, however, support an optional value, as indicated by john's usage output (--rules[=SECTION] and --single[=SECTION]). For a jumbo version, the completion logic for options --rules and --single depends on the contents of the environment variable __john_completion, see the last chapter ("Config variables") of this document. The default logic works like this: $ ./john --rules[tab][tab] will list possible completions like this: $ ./john --rules --rules --rules=single --rules=NT --rules=wordlist In the above example, the upper case section name NT indicates that the list of rules sections is a hard coded list of sections known to exist in (almost) every john version. For more recent versions which support the --list=rules option, the list of section names will be obtained by interpreting the config file (default john.conf or john.ini, unless another config file is specified on the command line, see john's option --config=...) In this case, the list of possible completions looks like this: $ ./john --rules --rules --rules=single --rules=nt --rules=wordlist (Please note that in this case all section names are lower case, because john doesn't distinguish upper and lower case characters in section names.) If you add a section [List.Rules:My_Test] to john.conf, $ ./john --rules[tab][tab] will list possible completions like this: $ ./john --rules --rules --rules=nt --rules=wordlist --rules=my_test --rules=single Since --single can use the same sections, $ ./john --single[tab][tab] will list possible completions like this: $ ./john --single --single --single=nt --single=wordlist --single=my_test --single=single If you use another config file name my.conf with these rules sections [List.Rules:some_rules] [List.Rules:more_rules] you can specify this config file on the command line. $ ./john --conf=my.conf --rules[tab][tab] will list possible completions like this: $ ./john --conf=my.conf --rules --rules --rules=some_rules --rules=more_rules The same possible completions are listed of you switch the sequence of the options on the command line, place the cursor immediately after the word "--rules", and press the [tab] key twice. $ ./john --rules[tab][tab] --config=my.conf will list possible completions like this: $ ./john --rules --config=my.conf --rules --rules=some_rules --rules=more_rules $ ./john --rules=s[tab] --config=my.conf will become $ ./john --rules=some_rules --config=my.conf --incremental The option --incremental can be used with and without a value. Possible values are the Incremental sectiom names defined in john.conf (or another config file specified with --config=..., see the description of the completion logic for --rules and --single). The completion logic depends on the contents of the environment variable __john_completion, see the last chapter ("Config variables") of this document. The default logic works like this: If the john version doesn't support the --list=inc-modes option, possible completions will be listed based on the john version and incremental mode sections known to exist in (almost) all john versions: $ ./john --incremental[tab][tab] will list possible completions like this: $ ./john --incremental --incremental --incremental=Alnum --incremental=Digits --incremental=All --incremental=Alpha --incremental=LanMan If the john version supports --list=inc-modes, the possible completions will be obtained by interpreting the config file (default john.conf or john.ini, unless another config file is specified on the command line, see john's option --config=...). In this case, the possible completions listed might look like this: $ ./john --incremental --incremental --incremental=all7 --incremental=digits --incremental=all --incremental=all8 --incremental=digits8 --incremental=all15 --incremental=alnum --incremental=lanman --incremental=all6 --incremental=alpha $ ./john --incremental=l[tab] will become $ ./john --incremental=lanman If all the incremental mode names are listed in lower case, you can also use $ ./john --incremental=L[tab] This will become $ ./john --incremental=lanman as well. --external If the john version supports the --list=externals option, the possible completions will be obtained by interpreting the config file (default john.conf or john.ini, unless another config file is specified on the command line, see john's option --config=...). In this case, the possible completions listed might look like this: $ ./john --external= appendluhn filter_alnum atleast1-generic filter_alpha atleast1-simple filter_digits autoabort filter_lanman autostatus filter_no_cap_or_symbols datetime keyboard double knownforce double10 lanman double10_alnum parallel1_2 double_all parallel2_2 double_alnum policy dumb16 repeats dumb32 strip dumbforce subsets (A config file specified on the command line will be taken into account when determining the possible completions, see the description of the completion for the options --incremental, --rules and --single.) If the john version doesn't support the --list=externals option, the possible completions are hard coded, depending on the john version you try to run. In this case, the possible completions listed might look like this: $ ./john --external= AppendLuhn DateTime Filter_Digits Parallel AtLeast1-Generic Double Filter_LanMan Policy AtLeast1-Simple DumbForce Keyboard Repeats AutoAbort Filter_Alnum KnownForce Strip AutoStatus Filter_Alpha LanMan Subsets (john version 1.7.9-jumbo-5) For john version 1.7.8, the list will look like this: $ john --external= AppendLuhn DumbForce Keyboard Repeats AtLeast1-Generic Filter_Alnum KnownForce Strip AtLeast1-Simple Filter_Alpha LanMan Subsets DateTime Filter_Digits Parallel Double Filter_LanMan Policy $ john --external=Da[tab] will become $ john --external=DateTime --make-charset= Completion will list names of .chr files and directories in the current directory for completion. $ ./john --make-charset=[tab][tab] might list completions like this: $ ./john --make-charset= all.chr alpha.chr lanman.chr alnum.chr digits.chr subdir/ Please note that an existing file will be overwritten when executing the command. So please be careful! --config= If the john version supports the --config= option, possible completions are all directory names and file names with the extensions .conf and .ini. (Files with extensions .CONF, .INI, .Conf, .Ini will also be considered, because the search is not case sensitive.) --pot= If the john version supports the --pot= options, possible completions are all directory names and file names with the extension .pot. (The search is not case sensitive, so file names with extensions .POT and .Pot will also be considered during completion.) --restore and --status The options --restore and --status can be used without a value (in this case, the session name will be "john") or with a value (session name). Since names of john sessions are possible completions, the possible completions are derived from .rec file names. In addition, names of sub directories are also considered, since .rec files might be located in a sub directory. (For --restore=, only names of sessions not currently running should be considered. This is not yet implemented.) The completion logic for these options depends on the contents of the environment variable __john_completion, see the last chapter ("Config variables") of this document. The default logic works like this: $ ls *.rec john.rec test1.rec $ ls -d subdir/ testdata/ subdir/ testdata/ $ john --status[tab][tab] will list possible completions like this: $ john --status --status --status=subdir --status=testdata --status=john --status=test1 A similar list of completions for --restore: $ john --restore --restore --restore=subdir --restore=testdata --restore=john --restore=test1 $ john --restore=[tab][tab] will list possible completions like this: $ john --restore= john subdir/ test1 testdata/ $ john --restore=t[tab] will become $ john --restore=test $ john --restore=test[tab][tab] will list possible completions like this: $ john --restore=test test1 testdata/ Config variables COMP_WORDBREAKS You shouldn't change the contents of this variable unless you really know what you are doing! Usually, you should leave this value unchanged. (You never know which other completion scripts depend on the contents of COMP_WORDBREAKS.) Use the following command to show the contents of COMP_WORDBREAKS: $ echo "$COMP_WORDBREAKS" "'><=;|&(: You can also use: $ echo $COMP_WORDBREAKS "'><=;|&(: (Note that with the second command (without quotes), you'll not see that the variable also contains a line feed character.) The completion logic implemented for john depends on whether or not COMP_WORDBREAKS contains the colon character (':'). If COMP_WORDBREAKS doesn't contain the colon, this is the completion logic: $ john -opt:val[tab] becomes $ john -opt=val $ john -opt:[tab] becomes $ john -opt= This means, for an option (beginning with at least one '-' char) followed by a colon (':') as a delimiter, possibly followed by other characters (except '=' or ':') the colon will be replaced by an equal sign. Pressing the [tab] key again will then invoke the normal completion logic as described throughout this document. To remove the colon from COMP_WORDBREAKS, use: $ COMP_WORDBREAKS="${COMP_WORDBREAKS//:/}" To add the colon to COMP_WORDBREAKS, use: $ COMP_WORDBREAKS="${COMP_WORDBREAKS}:" As always, the $ indicates the command prompt, and it is not part of the command. If you want to add this command to your ~/.bashrc, you'll have to use COMP_WORDBREAKS="${COMP_WORDBREAKS//:/}" or COMP_WORDBREAKS="${COMP_WORDBREAKS}:" __john_completion The value of the variable __john_completion is used to adjust the completion logic for options that can be used either with a value or without a value. These options are --restore --status --incremental Furthermore, in jumbo versions, these options can be used with or without a value: --rules --single --show (There are other options that can be used with or without a value. But the completion logic for those other options is more or less limited to a usage hint, and therefor doesn't depend on the value of the variable __john_completion.) For the option --show, the completion logic will always work like this: $ ./john -sho[tab] becomes $ ./john --show The cursor is positioned exactly after the "w", no trailing space is added in this case. (For an option that doesn't allow any values, a trailing space would be added.) If __john_completion is not defined or has any other value than 2, the default completion logic is used. It works like this: $ ./john --show[tab] just lists the possible completions like this: $ ./john --show --show --show=LEFT To add a file name, you'll first have to add the space, to separate the file name from the option name. To further expand the option instead, you'll have to type the '=' (equal sign). If __john_completion has the value 2, the following alternative completion logic is implemented for options that can be used with or without a value. $ ./john --show[tab] will become $ ./john --show= Completion of --option= does not depend on the value of __john_completion. Since there is just one possible value for --show=, $ ./john --show=[tab] will become $ ./john --show=LEFT (A space character will be added after "--show=LEFT".) So, if you prefer to hit the [tab] key instead of typing '=', you might want to add this line to your ~/.bashrc file: __john_completion=2