The quality of a dictionary attack depends entirely on the quality of the wordlist. In this lesson we explore where to find wordlists, how to generate custom ones with Crunch and CeWL, and how to supercharge them with Hashcat rules.
Not all wordlists are created equal. The best ones are derived from real-world password leaks, because they reflect how actual humans choose passwords.
/usr/share/wordlists/rockyou.txt. It remains the most widely used wordlist in password cracking.
Crunch generates wordlists based on character sets and length ranges. It is exhaustive — it creates every possible combination within the specified parameters.
# Generate all passwords from 8 to 10 characters (default charset)
crunch 8 10 -o custom_dict.txt
# Specify a custom character set (lowercase + digits)
crunch 8 10 abcdefghijklmnopqrstuvwxyz0123456789 -o custom_dict2.txt
# Use a pattern: @=lowercase, ,=uppercase, %=digits, ^=symbols
crunch 8 8 -t @@@@%%%% -o pattern_dict.txtCeWL spiders a target website and extracts unique words to build a wordlist. This is invaluable when targeting an organization — employees often use company-related terms as passwords.
# Basic usage — spider a website and save words
cewl -w web_dict.txt http://example.com
# Set minimum word length and spider depth
cewl -m 6 -d 3 -w web_dict.txt http://example.com
# Include email addresses found on the site
cewl -e -w web_dict.txt http://example.com
# Also extract words from metadata of downloadable files
cewl --meta -w web_dict.txt http://example.comRules transform each word in a wordlist into multiple candidates at runtime — without increasing the wordlist file size. This is one of Hashcat's most powerful features.
| Rule File | Rules | Description |
|---|---|---|
best64.rule | 64 | The most effective 64 rules. Great starting point. |
d3ad0ne.rule | ~34,000 | Large, aggressive rule set for thorough attacks. |
dive.rule | ~99,000 | Extremely comprehensive. Use when time is not a constraint. |
toggles1-5.rule | varies | Toggle case at positions 1 through 5. |
# Apply best64 rules to rockyou.txt
hashcat -m 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.ruleEach line in a rule file is a sequence of operations applied to every word. Understanding the syntax lets you write your own custom rules.
| Rule | Name | Example: "password" |
|---|---|---|
: | Do nothing (passthrough) | password |
c | Capitalize first letter | Password |
u | Uppercase all | PASSWORD |
l | Lowercase all | password |
t | Toggle case of all | PASSWORD |
$1 | Append "1" | password1 |
$! | Append "!" | password! |
^1 | Prepend "1" | 1password |
r | Reverse | drowssap |
d | Duplicate | passwordpassword |
sa@ | Replace a with @ | p@ssword |
# Combined rule: capitalize + append "123"
# Rule line: c $1 $2 $3
# "password" → "Password123"Real-world attacks often use multiple wordlists. Combining them removes duplicates and produces a single, optimized file.
# Merge two wordlists, sort, and remove duplicates
cat dict1.txt dict2.txt | sort -u > combined.txt
# Count lines (unique passwords)
wc -l combined.txt
# Merge multiple files at once
cat rockyou.txt web_dict.txt custom_dict.txt | sort -u > mega_dict.txt
# Sort by frequency (if you have counts)
sort -t: -k2 -rn passwords_with_counts.txt | head -10000 > top10k.txt