GPEN · Question #432
192.168.116.9 Is an IP address forvvww.scanned-server.com. Why are the results from the two scans, shown below, different?
The correct answer is C. John.rec. John the Ripper's .rec file stores session checkpoint state, and its presence causes resumed sessions to produce different output than a fresh run.
Question
192.168.116.9 Is an IP address forvvww.scanned-server.com. Why are the results from the two scans, shown below, different?
Exhibit
Options
- AJohn.pot
- BJohn conf
- CJohn.rec
- DJohn.ini
How the community answered
(44 responses)- A5% (2)
- B5% (2)
- C77% (34)
- D14% (6)
Why each option
John the Ripper's .rec file stores session checkpoint state, and its presence causes resumed sessions to produce different output than a fresh run.
john.pot is the output file where successfully cracked password hashes are stored, not a session state or progress tracker.
john.conf is the configuration file defining rules, wordlists, and modes, and does not affect session resume behavior.
The john.rec file is John the Ripper's restore file, recording the exact position within a cracking session when it was interrupted or paused. When a second run encounters an existing john.rec, it resumes from that checkpoint instead of starting from the beginning, which explains why the two scans of the same target yield different results.
john.ini is not a recognized standard John the Ripper file and plays no role in session management or scan state.
Concept tested: John the Ripper session restore file and cracking state
Source: https://www.openwall.com/john/doc/OPTIONS.shtml
Topics
Community Discussion
No community discussion yet for this question.
