# Wordlist

## Public Wordlists

<table><thead><tr><th width="150">Wordlists</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://weakpass.com/">Weakpass</a></td><td>Website with collection of password lists for various purposes. See also API.</td></tr><tr><td><a href="https://github.com/danielmiessler/SecLists">SecLists</a></td><td>Collection of multiple types of lists.</td></tr></tbody></table>

### Default Credentials

{% tabs %}
{% tab title="Tools" %}

<table><thead><tr><th width="156">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/ihebski/DefaultCreds-cheat-sheet">DefaultCreds-cheat-sheet</a></td><td><p>Default credentials collected from multiple sources.<br><code>creds update</code> </p><p><code>creds search &#x3C;STRING> [export]</code> </p></td></tr></tbody></table>
{% endtab %}

{% tab title="Wordlists" %}

* [CIRT.NET](https://www.cirt.net/passwords)
* [SecList](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/default-passwords.csv)
* [SCADAPASS](https://github.com/scadastrangelove/SCADAPASS/blob/master/scadapass.csv)
* [Router](https://www.softwaretestinghelp.com/default-router-username-and-password-list/)
  {% endtab %}
  {% endtabs %}

## Wordlist Generation

{% tabs %}
{% tab title="Tools" %}

<table><thead><tr><th width="132">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://salsa.debian.org/debian/crunch">crunch</a></td><td><code>crunch &#x3C;MIN> &#x3C;MAX> &#x3C;CHARSET> [-t &#x3C;PATTERN> -o &#x3C;OUTPUT>]</code><br><code>,</code> for all uppercase letters <br><code>@</code> for all lowercase letters<br><code>%</code> for all numeric characters<br><code>^</code> for all special characters<br><code>CONST</code></td></tr><tr><td><a href="https://github.com/digininja/CeWL">CeWL</a></td><td>Wordlists based on the content of websites.<br><code>cewl http://&#x3C;IP> -w &#x3C;OUTPUT> -d &#x3C;DEEP> -m &#x3C;MIN> -x &#x3C;MAX> --with-numbers --lowercase</code></td></tr><tr><td><a href="https://github.com/Mebus/cupp">cupp</a></td><td>Wordlists based on the profiling of a user.<br><code>cupp -i</code></td></tr><tr><td><a href="https://github.com/LandGrey/pydictor">pydictor</a></td><td>A powerful and useful hacker dictionary builder.<br><code>pydictor -sedb</code></td></tr><tr><td><a href="https://github.com/urbanadventurer/username-anarchy">username-anarchy</a></td><td>Tool for generating possible usernames.<br><code>username-anarchy &#x3C;NAME></code><br><code>username-anarchy -i &#x3C;FILE_NAMES></code></td></tr><tr><td><a href="https://github.com/digininja/RSMangler">RSMangler</a></td><td>Performs various manipulations on a wordlist.<br><code>rsmangler.rb -f &#x3C;WORDLIST></code></td></tr><tr><td><a href="https://hashcat.net/wiki/doku.php?id=rule_based_attack">hashcat</a></td><td><p>Apply rules to a wordlist (<code>/usr/share/hashcat/rules</code>)</p><pre data-title="Capitalization-First-Letter and Add X at the end"><code>c $! $0
c $0 $1
</code></pre><p><code>hashcat -r &#x3C;RULE_FILE> --stdout &#x3C;WORDLIST></code></p></td></tr></tbody></table>
{% endtab %}

{% tab title="Webssite" %}

* [Passgen (Weakpass) 1](https://weakpass.com/tools/passgen)
* [Passgen (Weakpass) 2](https://zzzteph.github.io/weakpass/passgen/dist/)
  {% endtab %}

{% tab title="To See" %}

<table><thead><tr><th width="132">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/sc0tfree/mentalist">mentalist</a></td><td>Graphical tool for generating custom wordlists that allows you to apply various rules.</td></tr><tr><td><a href="https://github.com/glitchedgitz/cook">cook</a></td><td>An overpower wordlist generator, splitter, merger, finder, saver, create words permutation and combinations, apply different encoding/decoding, etc.</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

### Common Patterns

Globally common passwords

{% code overflow="wrap" %}

```
password
qwerty
admin
123456
```

{% endcode %}

Season + year

{% code overflow="wrap" %}

```
Spring2024, Spring2024!
Summer2024, Summer2024!
Autumn2024, Fall2024, Fall2024!
Winter2025, Winter2025!
```

{% endcode %}

Company name/app/domain

{% code overflow="wrap" %}

```
app123, app2024, app2024!
Company01, Company!23
Domain123, Domain!
```

{% endcode %}

enterprise/IT patterns

{% code overflow="wrap" %}

```
Admin123, Admin1234, Admin123!
Password1, Password01, Password123, Password!
Welcome1, Welcome01, Welcome123
ChangeMe123, Changeme1
P@ssw0rd, P4ssword!, P@ssword1
User123, User2025, User01
```

{% endcode %}

Usernames pattern

{% code overflow="wrap" %}

```
David123, David2024, David!
```

{% endcode %}

Keyboard pattern

{% code overflow="wrap" %}

```
1234, 1234567, 987654321
123123, 112233
qwerty1, qwerty12, qwerty!
abc123
```

{% endcode %}

### Leaks

Searching for sensitive information via data breach

* [HaveIBeenPwned](https://haveibeenpwned.com/)
* [DeHashed](https://www.dehashed.com/)
* [IntelBase](https://intelbase.is/)
* [IntelligenceX](https://intelx.io/)
* [SnusBase](https://snusbase.com/)
* [Leak-Lookup](https://leak-lookup.com/)
* [DataBreach](https://databreach.com/)
* [BreachDirectory](https://breachdirectory.org/)
* [ScatteredSecrets](https://scatteredsecrets.com/)

## Filtering wordlist

It is very important to generate and use a wordlists that meets the **password requirements and policy**.

### I**nfer Policy**

You can **infer** the password complexity policy in use on the target in the following ways:

* Using the `user registration form`.
* If `policy is provided on first error`, and if `policy is provided after n attempts`.
* `guess policy by trial and error`, i.e., start with complex and appropriate password and then remove components to see if they are needed.

### Filter Wordlist

To **filter** the wordlist you can use `grep`\
`$` : Start/Append, **`^`** : End/Prepend

{% tabs %}
{% tab title="Filter" %}

<table><thead><tr><th width="425">Command</th><th>Details</th></tr></thead><tbody><tr><td><code>grep [-v] '[[:classname:]]' &#x3C;WORDLIST></code></td><td>Based on what they contain.<br><code>-v</code> (NOT contain)</td></tr><tr><td><code>grep -x '.\{&#x3C;LEN>\}’</code></td><td>Of exact length &#x3C;LEN></td></tr><tr><td><code>grep -E '^.{&#x3C;MIN>,&#x3C;MAX>}$'</code></td><td>Of length between &#x3C;MIN> and &#x3C;MAX></td></tr><tr><td><code>grep -E '^.{6,}$' &#x3C;WORDLIST> | grep -E '[A-Z]' | grep -E '[a-z]' | grep -E '[0-9]' | grep -E '([!@#$%^&#x26;*].*){2,}' > &#x3C;OUTPUT_FILE></code></td><td>Concatenation</td></tr></tbody></table>
{% endtab %}

{% tab title="classname" %}

<table><thead><tr><th width="172">Classname</th><th>Details</th></tr></thead><tbody><tr><td><code>[[:graph:]]</code> </td><td>All printable characters except spaces and control characters.</td></tr><tr><td><code>[[:lower:]]</code></td><td>All lowercase letters of the alphabet.</td></tr><tr><td><code>[[:print:]]</code></td><td>All printable characters, including spaces.</td></tr><tr><td><code>[[:punct:]]</code></td><td>All punctuation characters, such as commas, periods, semicolons, etc.</td></tr><tr><td><code>[[:space:]]</code></td><td>All spacing characters, including spaces, tabs, line feeds, etc.</td></tr><tr><td><code>[[:upper:]]</code></td><td>All capital letters of the alphabet.</td></tr><tr><td><code>[[:digit:]]</code></td><td>All digits, from 0 to 9</td></tr><tr><td><code>[[:xdigit:]]</code></td><td>All characters that are hexadecimal digits, that is, 0 to 9 and A to F (or a-f).</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

### Edit Wordlist

Or **edit** the wordlist with `sed`

<table><thead><tr><th width="371">Command</th><th>Details</th></tr></thead><tbody><tr><td><code>sed -ri '/^.{,7}$/d' &#x3C;WORDLIST></code></td><td>Remove shorter than 8</td></tr><tr><td><code>sed -ri '/[!-/:-@\[-`\{-~]+/!d' &#x3C;WORDLIST></code></td><td>Remove no special chars</td></tr><tr><td><code>sed -ri '/[0-9]+/!d' &#x3C;WORDLIST></code></td><td>Remove no numbers</td></tr><tr><td><code>sed -ri '/[A-Z]/!d' &#x3C;WORDLIST></code></td><td>Remove no uppercase</td></tr><tr><td><code>sed -ri '/[a-z]/!d' &#x3C;WORDLIST></code></td><td>Remove no lowercase</td></tr><tr><td><code>sed -r '/^.{,7}$/d' &#x3C;WORDLIST> | sed -r '/[!-/:-@\[-`\{-~]+/!d' | sed -r '/[0-9]+/!d' >> &#x3C;OUTPUT></code></td><td>Concatenation</td></tr></tbody></table>