Generate Wordlists

Theory

Having a good wordlist is critical to carrying out a successful password attack. It is important to know how you can generate username lists and password lists. In this section, we will discuss creating targeted username and password lists.

Practice

Generate a Wordlist

CeWL

Tools such as Cewl - Custom Word List generator can be used to effectively crawl a website and extract strings or keywords. Cewl is a powerful tool to generate a wordlist specific to a given company or target.

CeWL is a ruby app which spiders a given URL, up to a specified depth, and returns a list of words which can then be used for password crackers such as John the Ripper. Optionally, CeWL can follow external links.

cewl -w list.txt -d 5 -m 5 http://target.net

User List

Crunch

CUPP - OSINT

LDAPWordlistHarvester

Rule-Based Wordlists

Rule-Based attacks assume the attacker knows something about the password policy. Rules are applied to create passwords within the guidelines of the given password policy and should, in theory, only generate valid passwords. Using pre-existing wordlists may be useful when generating passwords that fit a policy — for example, manipulating or 'mangling' a password such as password: p@ssword, Pa$$word, Passw0rd, and so on.

Hashcat

Hashcat rule sets are located at /usr/share/hashcat/rules/. You can generate a wordlist using a rule as follow:

# Create wordlist from a rule
hashcat -r /usr/share/rules/best64.rule wordlist.txt --stdout > new_wordlist.txt

You can also use the OneRuleToRuleThemAll rule to generate a wordlist.

Create your own rules

To create your own rules, you definitely want to check this hashcat documentation, but here is an example of creating your custom rule and some notes about useful functions:

Description	Function	Example Rule	Ex. Input	Ex. Output
Append Char	$X	$1$2	Password	Password12
Prepend Char	^X	$1$2	Password	12Password
Capitalize the first letter and lower the rest	c	c	password	Password
Uppercase all letters	u	u	password	PASSWORD

Note that if the rule functions are:

• On the same line, separated by a space: Hashcat will use them consecutively on each password of the word list.

• On separate lines: Hashcat will use each rule separately on each password of the word list.

# Using following rule file:
# $1 c
$ hashcat -r my.rule password.txt --stdout 
Password1

# Using following rule file:
# $1
# c
$ hashcat -r my.rule password.txt --stdout
password1
Password

Let's assume an AD password policy that requires an upper case letter, a special character, and a numerical value. We may use the following rules along with hashcat:

# Rules file
# Capital letter at the beginning, 
# random number and special character at the end -> common human behaviour ;)
$ cat my.rule
c $1 $!
c $2 $!
c $1 $2 $3 $!

# Generate the wordlist
hashcat -r my.rule passwords.txt --stdout > new_passwords.txt

John

Psudohash

References

Password AttacksTryHackMe