Wordlists: Fuzzing & Password Cracking

A wordlist is a plain text file with one candidate per line, a password guess, a possible directory name, a possible subdomain. It sounds simple, but the right wordlist is often the entire difference between a scan that finds nothing and one that finds everything.

Wordlists power two very different jobs. Beginners often blur them together, so this lesson keeps them completely separate.

Finding wordlists already on your machine

Before downloading anything, check what is already installed. Two tools search for files, and they work very differently:

find / -name rockyou.txt 2>/dev/null      # walks the whole disk right now, slower but always current
locate rockyou.txt                        # reads a prebuilt index, instant, but can be stale
updatedb                                  # rebuilds locate's index if it's out of date

find searches live, directory by directory, so it is slower on a big disk but never lies. locate answers from a database built earlier by updatedb (often run nightly by the OS), so it's instant but might miss a file added seconds ago. Use locate for a quick check, find when you need certainty or to search by other properties (size, permissions, date).

find / -iname '*.txt' -path '*wordlist*' 2>/dev/null   # case-insensitive, narrowed to wordlist folders

Part 1 , Wordlists for Password Cracking

rockyou.txt

rockyou.txt is approximately 14.3 million real passwords leaked in the 2009 RockYou breach. It remains the default first attempt for cracking because people reuse the same weak passwords over and over.

wc -l /usr/share/wordlists/rockyou.txt   # ~14,344,392 lines
head /usr/share/wordlists/rockyou.txt    # 123456, password, iloveyou, ...

On Kali it ships at /usr/share/wordlists/rockyou.txt, sometimes compressed (gunzip rockyou.txt.gz to unpack it). If it isn't there, grab it from the SecLists repository or weakpass.com.

Offline vs online cracking

• Offline , you already have a captured password hash (from a database dump, a stolen file). john or hashcat tries every word in the list, hashes it, and compares. This never touches the target, so it is silent and unlimited.

  john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
  hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt   # -m 0 = MD5
  

• Online , no hash, just a live login form. hydra (or medusa) submits each word as a real login attempt. This is loud, slow, and can lock the account or trip a WAF, so use it sparingly and only in scope.

  hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://10.10.10.20
  

Generic lists vs targeted lists

rockyou.txt is generic, it was built from someone else's leaked passwords, not this target's. A generic list catches lazy, common passwords everywhere. A targeted list, built from facts about this specific organisation or person, catches the passwords a generic list will never contain: a company name, a founder's kid's name, a product launch year. The next section builds exactly that, starting from real people, not random guesses.

OSINT wordlists: turning real names into candidates

People build passwords out of things they know: their own name, their spouse, their pet, their company. Before you brute-force blindly, find out who you're actually attacking.

Start with the company's own website. An "About Us", "Leadership", or "Team" page routinely lists the CEO, CFO, CTO, and other executives by full name, sometimes with a short bio mentioning a hometown, a university, or a hobby. These are gold: C-level accounts hold the most privileged access, and their names are handed to you for free.

Documents leak authors too. Every PDF, Word doc, or spreadsheet a company publishes (annual reports, job postings, employee handbooks) carries hidden metadata, including the name of whoever created or last edited it, often their actual internal username.

cewl http://acme.com -d 2 -m 5              # crawl the site, collect words people might reuse in passwords
cewl http://acme.com -a                     # -a / --meta: pull author names out of linked PDFs and DOCX files
cewl http://acme.com -e                     # -e / --email: pull every email address found on the pages

Real scenario: cewl's metadata scan on Acme's public reports returns j.carter, m.osei, and r.nguyen, the authors of an annual report, an employee handbook, and board minutes. None of those names were on the website's visible "About" page, they only existed in file metadata nobody thought to scrub before publishing.

LinkedIn is the other big source. A company's LinkedIn page lists real employees by full name and job title, often hundreds of them. Manually browsing, or with OSINT tooling built for this (theHarvester's -b linkedin source, or dedicated scrapers), you can pull a large list of real staff names in minutes.

A raw name like "Jane Carter" isn't a username yet, most companies follow a predictable pattern (jcarter, jane.carter, j.carter). A permutation tool generates every likely format automatically instead of guessing by hand:

username-anarchy 'Jane Carter'
# jane, carter, jane.carter, janecarter, jcarter, janec, carter.jane, jane_carter, ...

Now you have real, high-confidence usernames. Combine that with a cracking list, or personalise the password guesses even further with CUPP:

cupp -i                          # interactive: enter one target's real details
# First Name: Jane   Surname: Carter   Birthdate: 14031986
# Partner: Alex   Child: Mia   Pet: Rusty   Company: Acme
# -> saves jane.txt: JaneCarter86, Rusty1986, AlexMia14, Acme2026!, ...

CUPP (Common User Passwords Profiler) builds a small, hyper-targeted wordlist from facts you already gathered via OSINT about one real person. It is far more powerful than a generic list for cracking that specific account, a few hundred well-informed guesses often beat 14 million blind ones, because you are no longer guessing at random, you are guessing like someone who knows them.

Building a custom password list from scratch

Sometimes you don't have names yet, just a target domain. Other generation tools:

• crunch , generates every combination of a character set and length.

  crunch 8 8 abc123               # every 8-char combo of a,b,c,1,2,3
  crunch 6 6 -t Pass%% -o wl.txt   # 'Pass' followed by two digits
  

  Watch the keyspace: length and charset size explode the file fast, plan before you generate millions of lines.
• hashcat rules , mutate a base list automatically (append years, capitalise, swap letters for numbers). Run this over your cewl/CUPP output too, not just rockyou.txt.

Part 2 , Wordlists for Fuzzing & Discovery

Fuzzing has nothing to do with passwords. Here the wordlist is a list of likely names, and you try each one as a URL path, a subdomain, or a parameter to see what exists.

SecLists , the discovery toolbox

SecLists (github.com/danielmiessler/SecLists) is a huge, organised collection built for exactly this:

• Discovery/Web-Content/ , directory and file names for content discovery.
• Discovery/DNS/ , subdomain names for DNS brute force.
• Fuzzing/ , injection payloads and edge-case values.
• Usernames/ and Passwords/ , the password-cracking lists live here too.

sudo apt install seclists           # Kali/Debian, lands in /usr/share/seclists
git clone https://github.com/danielmiessler/SecLists   # anywhere else
ls /usr/share/seclists/Discovery/Web-Content/common.txt

Fuzzing with a wordlist

gobuster dir -u http://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt
ffuf -u http://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Same tool, same wordlist idea, three different targets: a directory list finds hidden paths, a DNS list finds subdomains. The later lessons on directory discovery and subdomain enumeration build directly on this.

Try it (terminal)

1. find / -name rockyou.txt then locate rockyou.txt , compare the two search styles.
2. wc -l /usr/share/wordlists/rockyou.txt and head it , see the size and the worst passwords in the world.
3. cewl http://acme.com -a , pull leaked author names from the site's documents.
4. username-anarchy 'Jane Carter' , turn a real name into likely usernames.
5. cupp -i , build a personalised password list from one target's known details.
6. crunch 4 4 abc , generate a tiny custom list from scratch.
7. john hash.txt , crack a weak hash with rockyou (password cracking).
8. gobuster dir -u http://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt , fuzz for hidden paths (discovery).

Stay in scope

Cracking and brute force are only legal on systems you are authorised to test. Scraping public sites and LinkedIn for names is passive and generally low-risk, but using that data to attempt logins is active, only do it against accounts you are authorised to test. Online brute force is noisy and can lock out real users, prefer offline cracking of a captured hash whenever you have the choice.

Why this matters

The right wordlist, aimed at the right job, is the whole game. A cracking list finds a weak password in seconds; a discovery list finds the hidden /admin on the first run; and a wordlist built from a real executive's real name, birthdate, and pet often beats both, because you stopped guessing randomly and started guessing like someone who knows the target. Mixing these approaches up wastes time, keep them straight and you will reach for the right tool instantly.