Johnny may not be installed by default on every Kali Linux installation. So, first, we'll check whether it is already available on our system.

Let's open a terminal and run:

With Johnny successfully installed, you can launch it effortlessly. Simply locate Johnny in your application menu and click on it. 

As you do, the intuitive GUI interface of Johnny will open up, ready for use. 

Now, let's take a look at the different components of this interface and understand what each one does.

At the top, we have the menu bar.

It contains four main menus:

• File
• Attack
• Passwords
• Help

Let's start with the File menu.

The File menu provides options for loading password or hash data into Johnny. This is where we can either load a password file or load another file format to be used by the *2john utility.

Once the appropriate file has been loaded, its contents and status can be displayed in the main working area.

Next is the Attack menu.

This menu provides controls for starting, resuming, pausing, and managing password-auditing operations.

The Passwords menu contains functions related to the password entries currently loaded into Johnny.

Depending on the version, these functions can include filtering, including or excluding entries from an attack, copying selected information, and exporting results.

Finally, we have the Help menu.

This provides access to information and documentation related to Johnny and its usage.

Now, just below the menu bar, we have the main toolbar.

You can think of the toolbar as a collection of shortcuts for some of the most commonly used functions.

The first option is Open Password File.

This performs essentially the same function as the corresponding option in the File menu.

It allows us to load our password or hash file into Johnny.

Next, we have Open Session.

This allows us to open a previously saved John session and continue working with it.

Then we have Start New Attack.

This starts a new password-auditing task using the configuration we've selected.

The Resume Attack option allows us to continue a previously paused or saved operation.

Next is Pause Attack.

As the name suggests, this temporarily pauses the current operation.

We also have Guess Password, which provides access to password-guessing functionality within Johnny.

The Copy option allows us to copy selected information from the interface.

And finally, we have Export, which allows us to export available information or results.

Now, let's move to the left side of the window. Here, we have the main navigation panel.

The first section is Passwords.

This is where we can view the password or hash entries that have been loaded into Johnny.

Next, we have Options.

This section is used to configure the current session and select how John the Ripper should perform the password-auditing operation.

We also have Statistics.

This section provides information about the current operation, such as progress and other available statistics.

Next is Settings.

This contains configuration options related to Johnny and its environment.

And finally, we have Console Log.

The console log displays messages generated during the operation, which can help us understand what Johnny and John the Ripper are doing in the background.

Now, let's move to the Options section.

This section is used to configure the current Johnny session and choose how John the Ripper should perform the password-auditing task.

At the top, we have Session Details.

We'll look at these options and the available attack modes in the next part of the demonstration.

The first field is Session Name.

This allows us to give the current session a name. A session name is useful when we want to identify, save, or resume a particular John the Ripper task later.

Next, we have Input Password Files.

This shows the password or hash files that will be used as input for the current session.

Next is Current Hash Format.

This setting tells John what type of hash it should expect in the input file. At the moment, it is set to Default.

John may try to identify the hash format automatically, but when we already know the format, specifying it explicitly can help avoid detection problems.

For example, our previous laboratory example used a raw MD5 hash.

One useful message displayed here is:

“Modified attack options come into effect only when starting a new attack.”

This means that if we change an attack setting, the new configuration will be applied when we start a new attack. Changing an option does not automatically modify an attack that is already running.

Now, let's look at the Attack Mode section.

Johnny provides several attack modes, and each mode uses a different method for generating or testing password candidates.

Let's go through them one by one.

Default

The Default mode uses John's normal sequence of attack modes with the default configuration.

As shown in Johnny, John may run Single Crack mode, followed by Wordlist mode, and then Incremental mode.

This is useful when we want John to use its standard workflow instead of selecting one specific method manually.

Single Crack

Next is Single Crack mode.

This mode is designed to generate password candidates from information associated with the input account or password entry, and then apply John's cracking rules to those candidates.

The idea is to test likely password variations before moving to broader password-search methods.

For a demonstration, this mode helps us understand how John can generate candidates from available account information rather than relying only on an external wordlist.

Wordlist

Next, we have Wordlist mode.

This is one of the most commonly used modes in practical password auditing.

Here, John takes password candidates from a wordlist and tests them against the target hashes.

For example, we can provide our own laboratory wordlist, such as:

passwords.txt

John then processes the candidates from that file and checks for matches.

This mode is especially useful when we have a relevant and authorized candidate list.

Incremental

Next is Incremental mode.

This mode is designed for a much broader password search.

Instead of taking candidates only from a predefined wordlist, John generates candidate passwords according to the incremental configuration and tests them.

The search can become very large, depending on the character set, length, and configuration.

So, while this mode can be useful for password auditing, it may also require significantly more time and computing resources.

External

Next is External mode.

This mode allows John to use an external program or custom candidate-generation logic to produce password candidates.

In other words, instead of relying entirely on John's built-in candidate-generation methods, an external mode can provide customized input.

This is mainly useful for advanced users who need specialized password-generation behavior.

Mask

Next is Mask mode.

Mask-based attacks allow us to describe the expected structure of a password.

For example, we can specify that certain positions should contain numbers, letters, or other character types.

This can greatly reduce the search space when we already know something about the password's structure.

For example, if an authorized test password is known to contain a specific number of characters and a particular character pattern, a mask can represent that pattern.

Markov

Next is Markov mode.

Markov-based password generation uses statistical information about character sequences to prioritize password candidates that are more likely to occur.

Instead of treating every possible combination equally, it can favor combinations based on learned character-transition probabilities.

This allows John to focus its search on candidates that are statistically more likely.

PRINCE

Finally, we have PRINCE.

PRINCE is a password-candidate generation technique that works by combining and rearranging words from an input wordlist to create new candidates.

The name stands for PRobability INfinite Chained Elements.

This can be useful when passwords are composed of multiple words or word combinations.

For example, a password might be constructed from several recognizable words rather than being a completely random string.

So, these are the main attack modes available in the Johnny interface shown here.

Each mode has a different purpose.

• Default uses John's standard sequence.
• Single Crack focuses on candidates derived from account-related information.
• Wordlist tests candidates from a supplied list.
• Incremental generates a broader set of candidates.
• External allows customized candidate generation.
• Mask searches according to a defined password pattern.
• Markov prioritizes candidates using statistical character relationships.
• And PRINCE generates candidates by combining elements from a wordlist.

For our practical demonstrations, we'll mainly focus on Wordlist mode, because it is straightforward to understand and works well with the controlled laboratory examples we're using.

Now, let's look at the main working area in the center of the window.

At the top, we have the Filter field.

We can use this field to filter the entries displayed in the main list.

Next, we have Select Columns.

This allows us to choose which columns should be visible in the results table.

We also have options such as Show only checked and Show only cracked.

These options help us narrow down the entries displayed in the list.

The large area below is where the loaded password hashes and their current status are displayed.

At the bottom, we have the progress indicator.

At the moment, it shows zero percent because we haven't started a new attack yet.