> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/pentesting-process/password-cracking/wordlist.md).

# Wordlist

## Public Wordlists

<table><thead><tr><th width="150">Wordlists</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://weakpass.com/">Weakpass</a></td><td>Website with collection of password lists for various purposes. See also API.</td></tr><tr><td><a href="https://github.com/danielmiessler/SecLists">SecLists</a></td><td>Collection of multiple types of lists.</td></tr></tbody></table>

### Default Credentials

{% tabs %}
{% tab title="Tools" %}

<table><thead><tr><th width="156">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/ihebski/DefaultCreds-cheat-sheet">DefaultCreds-cheat-sheet</a></td><td><p>Default credentials collected from multiple sources.<br><code>creds update</code> </p><p><code>creds search &#x3C;STRING> [export]</code> </p></td></tr></tbody></table>
{% endtab %}

{% tab title="Wordlists" %}

* [CIRT.NET](https://www.cirt.net/passwords)
* [SecList](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/default-passwords.csv)
* [SCADAPASS](https://github.com/scadastrangelove/SCADAPASS/blob/master/scadapass.csv)
* [Router](https://www.softwaretestinghelp.com/default-router-username-and-password-list/)
  {% endtab %}
  {% endtabs %}

## Wordlist Generation

{% tabs %}
{% tab title="Tools" %}

<table><thead><tr><th width="132">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://salsa.debian.org/debian/crunch">crunch</a></td><td><code>crunch &#x3C;MIN> &#x3C;MAX> &#x3C;CHARSET> [-t &#x3C;PATTERN> -o &#x3C;OUTPUT>]</code><br><code>,</code> for all uppercase letters <br><code>@</code> for all lowercase letters<br><code>%</code> for all numeric characters<br><code>^</code> for all special characters<br><code>CONST</code></td></tr><tr><td><a href="https://github.com/digininja/CeWL">CeWL</a></td><td>Wordlists based on the content of websites.<br><code>cewl http://&#x3C;IP> -w &#x3C;OUTPUT> -d &#x3C;DEEP> -m &#x3C;MIN> -x &#x3C;MAX> --with-numbers --lowercase</code></td></tr><tr><td><a href="https://github.com/Mebus/cupp">cupp</a></td><td>Wordlists based on the profiling of a user.<br><code>cupp -i</code></td></tr><tr><td><a href="https://github.com/LandGrey/pydictor">pydictor</a></td><td>A powerful and useful hacker dictionary builder.<br><code>pydictor -sedb</code></td></tr><tr><td><a href="https://github.com/urbanadventurer/username-anarchy">username-anarchy</a></td><td>Tool for generating possible usernames.<br><code>username-anarchy &#x3C;NAME></code><br><code>username-anarchy -i &#x3C;FILE_NAMES></code></td></tr><tr><td><a href="https://github.com/digininja/RSMangler">RSMangler</a></td><td>Performs various manipulations on a wordlist.<br><code>rsmangler.rb -f &#x3C;WORDLIST></code></td></tr><tr><td><a href="https://hashcat.net/wiki/doku.php?id=rule_based_attack">hashcat</a></td><td><p>Apply rules to a wordlist (<code>/usr/share/hashcat/rules</code>)</p><pre data-title="Capitalization-First-Letter and Add X at the end"><code>c $! $0
c $0 $1
</code></pre><p><code>hashcat -r &#x3C;RULE_FILE> --stdout &#x3C;WORDLIST></code></p></td></tr></tbody></table>
{% endtab %}

{% tab title="Webssite" %}

* [Passgen (Weakpass) 1](https://weakpass.com/tools/passgen)
* [Passgen (Weakpass) 2](https://zzzteph.github.io/weakpass/passgen/dist/)
  {% endtab %}

{% tab title="To See" %}

<table><thead><tr><th width="132">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/sc0tfree/mentalist">mentalist</a></td><td>Graphical tool for generating custom wordlists that allows you to apply various rules.</td></tr><tr><td><a href="https://github.com/glitchedgitz/cook">cook</a></td><td>An overpower wordlist generator, splitter, merger, finder, saver, create words permutation and combinations, apply different encoding/decoding, etc.</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

### Common Patterns

Globally common passwords

{% code overflow="wrap" %}

```
password
qwerty
admin
123456
```

{% endcode %}

Season + year

{% code overflow="wrap" %}

```
Spring2024, Spring2024!
Summer2024, Summer2024!
Autumn2024, Fall2024, Fall2024!
Winter2025, Winter2025!
```

{% endcode %}

Company name/app/domain

{% code overflow="wrap" %}

```
app123, app2024, app2024!
Company01, Company!23
Domain123, Domain!
```

{% endcode %}

enterprise/IT patterns

{% code overflow="wrap" %}

```
Admin123, Admin1234, Admin123!
Password1, Password01, Password123, Password!
Welcome1, Welcome01, Welcome123
ChangeMe123, Changeme1
P@ssw0rd, P4ssword!, P@ssword1
User123, User2025, User01
```

{% endcode %}

Usernames pattern

{% code overflow="wrap" %}

```
David123, David2024, David!
```

{% endcode %}

Keyboard pattern

{% code overflow="wrap" %}

```
1234, 1234567, 987654321
123123, 112233
qwerty1, qwerty12, qwerty!
abc123
```

{% endcode %}

### Leaks

Searching for sensitive information via data breach

* [HaveIBeenPwned](https://haveibeenpwned.com/)
* [DeHashed](https://www.dehashed.com/)
* [IntelBase](https://intelbase.is/)
* [IntelligenceX](https://intelx.io/)
* [SnusBase](https://snusbase.com/)
* [Leak-Lookup](https://leak-lookup.com/)
* [DataBreach](https://databreach.com/)
* [BreachDirectory](https://breachdirectory.org/)
* [ScatteredSecrets](https://scatteredsecrets.com/)

## Filtering wordlist

It is very important to generate and use a wordlists that meets the **password requirements and policy**.

### I**nfer Policy**

You can **infer** the password complexity policy in use on the target in the following ways:

* Using the `user registration form`.
* If `policy is provided on first error`, and if `policy is provided after n attempts`.
* `guess policy by trial and error`, i.e., start with complex and appropriate password and then remove components to see if they are needed.

### Filter Wordlist

To **filter** the wordlist you can use `grep`\
`$` : Start/Append, **`^`** : End/Prepend

{% tabs %}
{% tab title="Filter" %}

<table><thead><tr><th width="425">Command</th><th>Details</th></tr></thead><tbody><tr><td><code>grep [-v] '[[:classname:]]' &#x3C;WORDLIST></code></td><td>Based on what they contain.<br><code>-v</code> (NOT contain)</td></tr><tr><td><code>grep -x '.\{&#x3C;LEN>\}’</code></td><td>Of exact length &#x3C;LEN></td></tr><tr><td><code>grep -E '^.{&#x3C;MIN>,&#x3C;MAX>}$'</code></td><td>Of length between &#x3C;MIN> and &#x3C;MAX></td></tr><tr><td><code>grep -E '^.{6,}$' &#x3C;WORDLIST> | grep -E '[A-Z]' | grep -E '[a-z]' | grep -E '[0-9]' | grep -E '([!@#$%^&#x26;*].*){2,}' > &#x3C;OUTPUT_FILE></code></td><td>Concatenation</td></tr></tbody></table>
{% endtab %}

{% tab title="classname" %}

<table><thead><tr><th width="172">Classname</th><th>Details</th></tr></thead><tbody><tr><td><code>[[:graph:]]</code> </td><td>All printable characters except spaces and control characters.</td></tr><tr><td><code>[[:lower:]]</code></td><td>All lowercase letters of the alphabet.</td></tr><tr><td><code>[[:print:]]</code></td><td>All printable characters, including spaces.</td></tr><tr><td><code>[[:punct:]]</code></td><td>All punctuation characters, such as commas, periods, semicolons, etc.</td></tr><tr><td><code>[[:space:]]</code></td><td>All spacing characters, including spaces, tabs, line feeds, etc.</td></tr><tr><td><code>[[:upper:]]</code></td><td>All capital letters of the alphabet.</td></tr><tr><td><code>[[:digit:]]</code></td><td>All digits, from 0 to 9</td></tr><tr><td><code>[[:xdigit:]]</code></td><td>All characters that are hexadecimal digits, that is, 0 to 9 and A to F (or a-f).</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

### Edit Wordlist

Or **edit** the wordlist with `sed`

<table><thead><tr><th width="371">Command</th><th>Details</th></tr></thead><tbody><tr><td><code>sed -ri '/^.{,7}$/d' &#x3C;WORDLIST></code></td><td>Remove shorter than 8</td></tr><tr><td><code>sed -ri '/[!-/:-@\[-`\{-~]+/!d' &#x3C;WORDLIST></code></td><td>Remove no special chars</td></tr><tr><td><code>sed -ri '/[0-9]+/!d' &#x3C;WORDLIST></code></td><td>Remove no numbers</td></tr><tr><td><code>sed -ri '/[A-Z]/!d' &#x3C;WORDLIST></code></td><td>Remove no uppercase</td></tr><tr><td><code>sed -ri '/[a-z]/!d' &#x3C;WORDLIST></code></td><td>Remove no lowercase</td></tr><tr><td><code>sed -r '/^.{,7}$/d' &#x3C;WORDLIST> | sed -r '/[!-/:-@\[-`\{-~]+/!d' | sed -r '/[0-9]+/!d' >> &#x3C;OUTPUT></code></td><td>Concatenation</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ivalexev.gitbook.io/rednote/pentesting-process/password-cracking/wordlist.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.