Which command shows the cracked passwords recorded by John the Ripper?

• A. cat password_file
• B. ./john --display [password_file]
• C. ./john --show [password_file]
• D. john --show [password_file]

Answer: (C)

The key idea is using John the Ripper’s show mode to reveal what has been cracked. After John runs, it records successful cracks in its potfile, and the show option reads that data and prints the user and password pairs that correspond to the hashes you provided. Invoking the local binary with the show flag is the correct way to display those results for the given hash file, because it directly queries John’s stored Cracked entries rather than just showing the original hash list. Using the dot-slash form emphasizes executing the binary from the current directory, which is a common practice in labs and practice environments. The other approaches don’t retrieve and display the cracked credentials: printing the hash file with cat just shows the hashes, and a nonstandard --display flag isn’t how John reports cracked passwords. If John is in the PATH, the same show option would work there too, but the essential action is using the show mode on the appropriate hash file to view the cracked passwords.