John是一款Kali linux自带的密码破解工具，支持密码本破解。John基于密码本破解root用户开机口令如下图所示，当然重点还是你有靠谱的密码本，否则也是白费力气。
unshadow /etc/passwd > hash.txt
john --user=root --wordlist=passwd hash.txt这里破解出了作者的root密码是h3ll0
那么如何破解ZIP加密文件呢？道理是一样的，先获得Hash文件，然后再上John工具。
第一步：zip2john获得中间Hash文件
zip2john passwd.zip > passwd.hash获得hash文件：passwd.hash
第二步：john破解中间Hash文件
john passwd.hash获得密码：123456，可以看出来这个密码破解过程来自自带的密码本password.lst，这个里面大约有3000个常用密码，但是如果设置的密码不在这里面，那么就很难破解了，我尝试设置了不在密码本中的密码1993，竟然很久都破解不出来，毕竟也是爆破嘛，非常不推荐使用这种方式来破解ZIP加密文件。
破解模式参数--incremental简介[1]
破解模式的具体方法 破解的密码长度 所包含的字符
Incremental:all 0-8 All 95 printable ASCII characters
Incremental:all15 0-5 All 95 printable ASCII characters
Incremental:all6 6 All 95 printable ASCII characters
Incremental:all7 7 All 95 printable ASCII characters
Incremental:all8 8 All 95 printable ASCII characters
Incremental:alpha 1-8 A-Z 纯大写字母
Incremental:digits 1-8 0-9 纯数字
Incremental:lanman 0-7 A-Z, 0-9, and some special characters 大写字母,数字加一些特殊字符帮助手册：
Usage: john [OPTIONS] [PASSWORD-FILES]
--single[=SECTION[,..]] "single crack" mode, using default or named rules
--single=:rule[,..] same, using "immediate" rule(s)
--wordlist[=FILE] --stdin wordlist mode, read words from FILE or stdin
--pipe like --stdin, but bulk reads, and allows rules
--loopback[=FILE] like --wordlist, but extract words from a .pot file
--dupe-suppression suppress all dupes in wordlist (and force preload)
--prince[=FILE] PRINCE mode, read words from FILE
--encoding=NAME input encoding (eg. UTF-8, ISO-8859-1). See also
doc/ENCODINGS and --list=hidden-options.
--rules[=SECTION[,..]] enable word mangling rules (for wordlist or PRINCE
modes), using default or named rules
--rules=:rule[;..]] same, using "immediate" rule(s)
--rules-stack=SECTION[,..] stacked rules, applied after regular rules or to
modes that otherwise don't support rules
--rules-stack=:rule[;..] same, using "immediate" rule(s)
--incremental[=MODE] "incremental" mode [using section MODE]
--mask[=MASK] mask mode using MASK (or default from john.conf)
--markov[=OPTIONS] "Markov" mode (see doc/MARKOV)
--external=MODE external mode or word filter
--subsets[=CHARSET] "subsets" mode (see doc/SUBSETS)
--stdout[=LENGTH] just output candidate passwords [cut at LENGTH]
--restore[=NAME] restore an interrupted session [called NAME]
--session=NAME give a new session the NAME
--status[=NAME] print status of a session [called NAME]
--make-charset=FILE make a charset file. It will be overwritten
--show[=left] show cracked passwords [if =left, then uncracked]
--test[=TIME] run tests and benchmarks for TIME seconds each
--users=[-]LOGIN|UID[,..] [do not] load this (these) user(s) only
--groups=[-]GID[,..] load users [not] of this (these) group(s) only
--shells=[-]SHELL[,..] load users with[out] this (these) shell(s) only
--salts=[-]COUNT[:MAX] load salts with[out] COUNT [to MAX] hashes
--costs=[-]C[:M][,...] load salts with[out] cost value Cn [to Mn]. For
tunable cost parameters, see doc/OPTIONS
--save-memory=LEVEL enable memory saving, at LEVEL 1..3
--node=MIN[-MAX]/TOTAL this node's number range out of TOTAL count
--fork=N fork N processes
--pot=NAME pot file to use
--list=WHAT list capabilities, see --list=help or doc/OPTIONS
--format=NAME force hash of type NAME. The supported formats can
be seen with --list=formats and --list=subformats
