Hacking & Cracking With Wordlists

Biohazard
Jul 19
3 min read

Hacking & Cracking With Wordlists

Here's your comprehensive wordlist reference for hacking & cracking. This is a(n) article / guide on cracking & hacking with wordlists.

Built-In Kali Linux Wordlists

bash

# All wordlist locations
ls /usr/share/wordlists/

# The essential:
/usr/share/wordlists/rockyou.txt.gz          # 14 million passwords (decompress first)
/usr/share/seclists/                          # SecLists — the gold standard
/usr/share/wordlists/dirb/                    # Directory fuzzing
/usr/share/wordlists/dirbuster/               # Larger directory lists
/usr/share/wordlists/wfuzz/                   # Parameter fuzzing
/usr/share/wordlists/metasploit/              # MSF default lists

bash

# Install missing essentials
sudo apt install seclists -y
sudo gunzip /usr/share/wordlists/rockyou.txt.gz

SecLists (Most Important)

SecLists is the pentest standard. Covers every category:

Directory	Use Case
Passwords/Common-Credentials/	10k, 100k, 1M most common passwords
Passwords/Leaked-Databases/	Real breached password lists
Discovery/Web-Content/	Directory fuzzing (raft, directory-list-2.3)
Discovery/DNS/	Subdomain brute-forcing
Usernames/	Default/common usernames by platform
Fuzzing/	SQLi, XSS, LFI payloads
Passwords/Software/	Default passwords for routers, IoT, software

bash

# Download latest directly
git clone https://github.com/danielmiessler/SecLists.git /opt/SecLists

Purpose-Built Wordlists

Password Cracking

bash

# rockyou.txt — best for quick dictionary attacks
# crackstation-human-only.txt — all human passwords ever leaked
# hashkiller-combined.txt — massive merged list

# Probable-Wordlists (generation-based)
git clone https://github.com/berzerk0/Probable-Wordlists.git
# Lists organized by length and complexity

Directory Brute-Forcing (ffuf, gobuster, dirb)

bash

# Small (quick scan)
SecLists/Discovery/Web-Content/common.txt

# Medium (thorough)
SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt

# Large (exhaustive)
SecLists/Discovery/Web-Content/raft-large-directories.txt

# Specific tech
SecLists/Discovery/Web-Content/CMS/wordpress.fuzz.txt
SecLists/Discovery/Web-Content/tomcat.txt
SecLists/Discovery/Web-Content/drupal.txt

bash

# Assetnote lists — one of the best
wget https://wordlists.assetnote.io/data/automated/httparchive_directories_1m_2024.txt
wget https://wordlists.assetnote.io/data/automated/httparchive_subdomains_2024.txt

Subdomain Enumeration

bash

# Small
SecLists/Discovery/DNS/subdomains-top1million-5000.txt

# Medium
SecLists/Discovery/DNS/subdomains-top1million-20000.txt

# Large (with recursion)
SecLists/Discovery/DNS/fierce-hostlist.txt

# Combined with tools
amass enum -w /path/to/subdomains.txt -d target.com

Parameter Fuzzing

bash

# Common parameters
SecLists/Discovery/Web-Content/burp-parameter-names.txt

# Assetnote param lists
wget https://wordlists.assetnote.io/data/automated/httparchive_parameters_top_1m.txt

Username Brute-Forcing

bash

SecLists/Usernames/top-usernames-shortlist.txt
SecLists/Usernames/Names/names.txt
SecLists/Usernames/xato-net-10-million-usernames.txt

Custom Wordlist Generation

CeWL (Website Spidering)

bash

# Scrape a target website, generate custom wordlist
cewl https://target-org.com -m 6 -w custom_words.txt
cewl https://target-org.com --depth 2 -m 4 -w deep_crawl.txt --lowercase
cewl -d 3 -m 5 --with-numbers -e --email_file emails.txt https://target-org.com -w full_output.txt

# Flags:
# -d 3  : spider depth
# -m 5  : minimum word length
# -e    : include email addresses
# --with-numbers : append numbers

Crunch (Pattern-Based Generation)

bash

# Generate all 6-8 char passwords from charset
crunch 6 8 abc123 -o passwords.txt

# Specific pattern (@ = lowercase, , = uppercase, % = numbers, ^ = symbols)
crunch 8 8 -t Pass@@@@ -o passwords.txt   # Pass + 4 lowercase
crunch 8 8 -t Corp%%^^ -o passwords.txt   # Corp + 2 digits + 2 symbols

# With charset file
crunch 8 8 -f /usr/share/crunch/charset.lst mixalpha-numeric -o full.txt

Hashcat Rules + Wordlists = Massive Lists

bash

# Combine a base wordlist with mutation rules
hashcat --stdout rockyou.txt -r /usr/share/hashcat/rules/best64.rule > mutated.txt

# Multiple rule chains
hashcat --stdout words.txt -r /usr/share/hashcat/rules/d3ad0ne.rule > huge_list.txt

# Common rule files:
/usr/share/hashcat/rules/best64.rule         # 64 best rules
/usr/share/hashcat/rules/d3ad0ne.rule        # 35,000+ rules
/usr/share/hashcat/rules/OneRuleToRuleThemAll.rule  # 50,000+ rules
/usr/share/hashcat/rules/leetspeak.rule      # l33t mutations only

Piping with awk/sed

bash

# Add common suffixes
cat base.txt | awk '{print $0"123"; print $0"2024"; print $0"!"}' > expanded.txt

# Case variations
cat base.txt | while read word; do
  echo $word
  echo ${word^}       # Capitalize first
  echo ${word^^}      # UPPERCASE
done > case_variants.txt

# Leet mutations
echo "password" | tr 'aeio' '4310'  # p4ssw0rd

Wordlist Optimization

Remove Duplicates / Sort

bash

sort -u input.txt > unique.txt
sort -u -R input.txt > randomized.txt    # -R randomizes

Filter by Length

bash

# Keep only 8+ characters
awk 'length($0) >= 8' input.txt > min8.txt

# Only 6-12 characters
awk 'length($0) >= 6 && length($0) <= 12' input.txt > midrange.txt

Filter by Complexity

bash

# Words that contain at least one digit
grep '[0-9]' input.txt > with_digits.txt

# Words that match org's password policy (example: 8+ chars, upper+lower+digit)
grep -P '^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$' input.txt > valid_policy.txt

Split Large Lists

bash

split -l 1000000 huge_list.txt chunk_
# Creates chunk_aa, chunk_ab, chunk_ac, etc.

Where To Get More Wordlists

bash

# WeakPass — massive password dumps
git clone https://github.com/zzzteph/weakpass.git

# Kerberos (username-focused)
wget https://github.com/insidetrust/statistically-likely-usernames/raw/master/john.smith.txt

# Security question answers (cities, colors, animals, etc.)
git clone https://github.com/anudeepND/secquestion.git

# FuzzDB (payloads and patterns)
git clone https://github.com/fuzzdb-project/fuzzdb.git

# Assetnote (production-crawled lists, excellent quality)
https://wordlists.assetnote.io/

# Trickest Wordlists (also production-crawled, updated regularly)
https://github.com/trickest/wordlists

Wordlist Strategy By Attack Type

Attack	Best List	Why
WPA2 handshake	rockyou.txt → hashcat + rules	Broad human password coverage
SSH brute-force	Probable-Wordlists (12+ chars)	SSH rate limits — prioritize long passwords
Web directory fuzz	Assetnote / raft-large-directories.txt	Real-world crawled paths
Subdomain enum	Assetnote subdomains / SecLists DNS	Comprehensive DNS coverage
API parameter fuzz	SecLists burp-parameter-names.txt	Common development patterns
AD password spray	Top 1,000 passwords + season+year suffix	Beat lockout policies
Custom org	CeWL from target site + names.txt + corporate lingo	Targeted to the org

Quick Command Reference

bash

# Password cracking
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# Directory fuzzing
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -u https://target.com/FUZZ
gobuster dir -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

# Subdomain enumeration
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
ffuf -w subdomains.txt -u https://FUZZ.target.com

# Username enumeration
kerbrute userenum --dc dc.target.com -d target.local users.txt

# Hydra / Medusa
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ssh://10.0.0.1