Chapter 3

Wordlists

You see those, “Top Passwords for Year 20XX” lists every year, and honestly, in my opinion they are just not really true anymore. Basic password requirements for servers mostly prevent the use of many of the passwords listed. In actively cracking public dump lists, the top passwords I have seen for the last several years are a combination of a person’s name (or names), numbers and possibly a symbol. People are creatures of habit, and patterns, and this is especially true when they create passwords. Names, important dates or numbers are easy to remember, so, these are usually what are used when creating a password. Many passwords also start with a capital letter and end with a symbol. It is hard to overcome years of proper language classes. 

I personally use Kali Linux for processing my wordlists, but I do most of my password cracking on a Windows 11 box. The most efficient cracking is done on a system with a very strong and fast GPU. In my...

Password Risks and Attacks

In today's digital age, where data and personal information are increasingly stored and transmitted online, the importance of using strong complex passwords cannot be overstated. Weak passwords remain one of the most significant vulnerabilities that can expose individuals and organizations to a wide range of cyber threats. But first, let’s look at the associated risks of weak passwords, underlining the critical role that strong passwords play in safeguarding digital assets.

Cybersecurity Attacks and Weak Passwords

1. Brute Force Attacks: Attackers use automated tools to guess passwords systematically until they find the correct one. Weak passwords, such as "123456" or "password," are easily cracked through these methods.
2. Dictionary Attacks: These attacks involve trying commonly used words or phrases as passwords. Weak passwords that include dictionary words are vulnerable to this method.
3. Credential Stuffing: Attackers employ previously...

Wordlists

You are a Pentester or a Red Team member in an active security assessment. You have recovered password hashes, but can’t pass them, or, use them as-is to gain further access. What are you to do? Crack them! Wordlists are very important when trying to crack passwords. Cracking programs can take a text file filled with words, also known as a wordlist or dictionary file, and use it to crack passwords. They literally take a word from the wordlist, encrypt it and compare it with the encrypted password hash. If it doesn’t match, it moves on to the next password. Most cracking programs use the wordlist directly word for word, while more advanced ones can also use the wordlist (or multiple wordlists) and manipulate them to create many new combinations of passwords to try. For example, some can take all the words in the wordlist and attach letters or numbers to the beginning or end of the word, or take two or more wordlist files and combine the words from both to make a...

Commonly Used Wordlists

➢      Ignis - https://github.com/ignis-sec/Pwdb-Public/tree/master/wordlists

➢      Packet Storm - https://packetstormsecurity.com/Crackers/wordlists/

➢      Weakpass - https://weakpass.com/wordlist

➢      Hashkiller - https://hashkiller.co.uk/

➢      Probable Wordlists - https://github.com/berzerk0/Probable-Wordlists

➢      G0tm1k - https://download.g0tmi1k.com/wordlists/large/

➢      SecLists - https://github.com/danielmiessler/SecLists

➢      Clem9669 - https://github.com/clem9669/wordlists

➢      Hashmob - https://hashmob.net

All links were active websites at the time of this writing, but may change over time. Some are single wordlists; some pages have numerous wordlists. Of these, the Ignis, Clem9669, and the Hashmob lists are my favorites. I feel these three are...

Wordlists for Directory Path or Server Brute Forcing

Of course, password cracking isn’t the only use for wordlists. Many security tools use wordlists for web or directory path enumeration. These tools aren’t cracking passwords, but use wordlists to automatically search for directories or files on servers. These lists contain things like common control panel & configuration file names and webserver data paths. 

➢      https://github.com/danielmiessler/SecLists

➢      https://gist.github.com/jhaddix

➢      https://wordlists.assetnote.io/

When you download wordlists, there are usually a lot of words that are duplicates or the wordlist can contain a lot of useless information. The following is a tool to clean up wordlists from useless or random junk:

➢      https://github.com/BonJarber/SecUtils - Clean Wordlist (I do disagree with classifying some symbols as “Noise...

Wordlists Included with Kali

Kali comes with several wordlists that you can use; the problem is just finding them. Most are in the directory of the main program that uses them. On the newer releases of Kali, shortcut links to the other wordlists are stored in the “/usr/share/wordlists” directory. You can also use the Kali Linux menu selection “05 – password Attacks > Wordlists” as a shortcut to this directory.

Rock You Wordlist

One of the most popular wordlists used in cracking is the, “Rock You” wordlist. This is a large collection of millions of passwords that were actually used and pulled from a database dump.

➢      The file is located in the Kali Linux “/usr/share/wordlists/” directory as seen below:

If you notice, the Rockyou wordlist is zipped, the latest version of Kali offers to unzip it for you, or you can do it manually:

You can use the “cat” command to view the...

Wordlist Generator Tools

Downloading existing wordlists is not your only option. Several tools in Kali let you make your own personalized wordlists. CeWL is pretty useful as it lets you create passwords by grabbing information from a target website. Crunch is nice too as it allows you to create your own custom wordlists from scratch. Let’s take a closer look at how to use these tools.

CeWL

Tool Author: Robin Wood

Tool Website: https://digi.ninja/projects/cewl.php

CeWL is a great tool for creating company related or theme-based wordlists. Many times, a user will create a password using words that relate to where they work or what they do. CeWL crawls a target website and builds a custom wordlist file using words found on the site.

➢      CeWL is no longer installed by default, but just type “cewl” to install.

To use CeWL, provide the options that you want and the target URL. For example, if we wanted to spider the website, “cyberarms.wordpress.com”, to a depth of 1 layer (-d 1) pull any words six characters or longer (-m 6) and save it as “cyberarms.txt”, we would use the following command:

➢      cewl -w cyberarms.txt -d 1 -m 6 https://cyberarms.wordpress.com/

CeWL crawls the target website and creates a wordlist with the terms that meet our criteria. The resultant text file might...

Crunch

Tool Authors: Mimayin, Bofh28

Tool Website: https://sourceforge.net/projects/crunch-wordlist/

Crunch is a great program that allows you to create your own custom password lists. Simple tell crunch what you want, the length and complexity, and Crunch makes it for you.

The Crunch manual page (in a Kali terminal, enter “man crunch”) contains complete instructions and examples on how to use the tool. Basically, all we need to tell crunch is the minimum and maximum length of the words, what type of characters to use, and Crunch does the rest. Crunch makes heavy use of the charset.lst file that is located in its install directory - “/etc/share/crunch”.  So, you will need to either run crunch from that directory or point to the directory with the “-f” switch when using the more advanced character sets (shown below).

Alright, let’s start with an easy one:

➢      At a terminal prompt, type, “crunch 1 3 ...

Crunch - Using the Charset.lst File

Crunch’s Charset.lst file contains a list of keywords that are pre-defined as alphanumeric or symbol strings. We can use these keywords so we don’t have to manually type in the characters that we want to use. The file is located in the “/usr/share/crunch” directory. If we view the file, we can see what keyword sets are available:

➢      cd /usr/share/crunch

➢      cat charset.lst

We can use any of the defined sets, for example:

➢      sudo crunch 2 4 -f charset.lst mixalpha-numeric-all -o mixedall.txt

This command creates a wordlist that cycles through two-to-four-character words that contains all letters, numbers and symbols. Most websites are requiring new accounts to use at least letter and number combinations. So having wordlists with these combinations are a good start.

It is also very common to have strings of numbers in passwords. I have seen them...

Crunch: Creating Unicode Wordlists

Many languages include Extended or Unicode character. We can make a wordlist using “Unicode” characters with Crunch. The “mixalpha-space-sv” character set contains some of them.

As seen below:

mixalpha-space-sv = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ ]

We can use this character set to build a wordlist.

➢      sudo crunch 3 5 -f charset.lst mixalpha-space-sv -o mixedall.txt

We now have a mixed character list for password cracking. We could take this and combine it with the previous “1 to 5 number” list for a pretty useful combination. Or we could use it in a hybrid attack having Hashcat add the numbers.

As seen below:

➢      hashcat --remove -m 0 uncracked.txt -o cracked.txt -i -a6 mixedall.txt ?d?d?d?d -O

We will cover Hashcat in depth in a later chapter. For now, just know that the command above would take...

Crunch - Creating More Advanced Wordlists

We can use multiple character sets when creating words in crunch. Humans are creatures of habit and patterns, so you will find patterns when you crack passwords. You can create a custom wordlist with crunch using any pattern.

Simply, list each character set that you want to use, then use the “@,%^” characters and create a mask, just like you would with Hashcat. The “@” symbol represents characters from the first character set. The “,” the second, “%” represents the third character set, etc. You then use the “-t” pattern switch to build your pattern.

WARNING: This can Fill a Hard Drive Fast – Ye Have Been Warned

Confusing right? Let’s see an example:

➢      sudo crunch 10 10 -f charset.lst mixalpha-space-sv symbols14-space ualpha -o mixedsymupper.txt -t @@@,,,,%%%

Don’t let this run for more than a couple seconds! It could generate a HUGE file. Hit “Ctrl-c” and look for the “START” file.

You should see words like this:

aaa!!!#VVR

baa!!$#WUS

aba!*!#KTT

cab&!!)SSU

You should see the pattern we built:

➢      3 letters from the mixedalpha-spave-sv characterset (@@@)

➢      4 symbols from the symbols14-space character set (,,,,)

➢      3 from the Upper Alpha character set (%%%)

Many times, you will find a word that is used over and over in password hashes, like a company name. Let’s say we find a string of passwords that have the fictitious company initials “WOW”, followed...

Hashcat - Creating Wordlists with Hashcat

A lot of Hashcat users don’t know that you can actually use the Hashcat tool itself to create wordlists. You can use any of the standard Hashcat “-a” attack commands to produce a wordlist. We will cover several of the Hashcat attack modes in a later chapter So, instead of walking through these step by step, I created a chart that shows some common uses: 

Again, you can use any of the “-a” attack modes that you wish, just make sure you use the “--stdout” switch. You can then specify an output file with “-o” or just use the “>” file redirect command. 

Hashcat Utils

Tool GitHub: https://github.com/hashcat/hashcat-utils

Tool Releases: https://github.com/hashcat/hashcat-utils/releases

Not too many in the security world know about the Hashcat Utilities. The utilities are a separate download from Hashcat and are a great set of resource tools for password cracking, and creating wordlists. You can download the Hashcat utilities from the tool website, then install by following the instructions provided on the site. For example, for a Windows install, you just unzip the latest release download and run the .exe you need.

Prepare Your Source Wordlists

Gather the wordlists you intend to combine. These can be standard dictionaries, common phrases, leaked passwords, or any other relevant sources. 

WARNING: Use very small wordlists, as this COULD fill your hard drive fast! The generated output file is exponentially bigger than the input files.

Using the Combinator Command:

The combinator command is used to generate wordlist combinations from...

Hashcat Keymap Walking Password Wordlists

Hashcat’s keymap walking tool, “KwProcessor”, quickly and easily generates password lists based on keymap walking techniques. Many users use keymap walk style passwords. In this section, we will take a quick look at how to use this tool.

Introduction

Keymap walking passwords are popular amongst many organizations, especially government entities. They are pretty easy to use and remember. Basically, you start with a specific key on the keyboard and then pick a direction (or multiple directions) and start hitting keys. Your password is entered as you “walk” across the keyboard.

You can create a complex password in this manner by using the shift key and including numbers in the pattern, as seen below:

Starting with the letter “z”, we move North West, hitting the “a”,”q”, and “1” keys. We then move East a row, hitting the number “2”, and then move South East back down the keyboard hitting the “w” key and stopping on “s”. This would create the password, “zaq12ws”. If we alternately used the shift key, we would get the password, “ZaQ1@wS” which is a little more complex.

What makes keymap...

Installing KwProcessor (kwp)

Like the Hashcat utils, kwp is an optional download from hashcat. Just download the latest release or you can make it from source. Downloading the latest release is the best option as it hasn’t been updated in a few years.

➢      Download the latest release - https://github.com/hashcat/kwprocessor/releases

➢      Extract the file

➢      Use “./kwp” to run the program

Keymaps and Routes

To crack keymap walking passwords you will need two things, a layout of the keyboard keys and a list of routes to take to create the wordlists. In the kwp program directory you will find the “keymaps” and “routes” folders:

The Keymaps folder contains the keyboard layout for multiple languages:

The routes folder has 7 preconfigured keymap walks or routes that can be used to generate passwords:

We can use these preconfigured routes or create our own using command line switches.

Type, “./kwp --help” to see the available options:

Creating a KWP Wordlist

To create a simple kwp wordlist, we will use the English keymap and the “2-10 max 3 directional changes” route file, as seen below:

➢      ./kwp basechars/full.base keymaps/en.keymap routes/2-to-10-max-3-direction-changes.route

This causes kwp to create multiple keymap walk combinations, of 2-11 characters with a maximum of 3 direction changes:

The output of the command is sent directly to the screen, so to create an output file you would need to output the command to a text file:

➢      ./kwp basechars/full.base keymaps/en.keymap routes/2-to-10-max-3-direction-changes.route > basickwp.txt

You can then use the resultant text file as a wordlist in Hashcat.

To create a more complex wordlist, use one of the larger route files:

➢      ./kwp basechars/full.base keymaps/en.keymap routes/2-to-16-max-3-direction-changes.route > largekwp.txt

Foreign Language Keywalks

If you need to crack foreign language keywalks, just use one of the foreign languages keymap files. 

So, to create a Russian keywalk wordlist:

➢      ./kwp basechars/full.base keymaps/ru.keymap routes/2-to-16-max-3-direction-changes.route > rukwp.txt

And the resultant file:

If we have a password hash list that contains any of the words that were generated, it will crack them.

The Hashcat KWP tool is great for quickly create keymap walking wordlists. It’s easy too to change the keymap language, which can come in handy if you are cracking international passwords. If you want to learn more about KWP, check out the Hashcat GitHub page - https://github.com/hashcat/kwprocessor

Wordlist Wrap-up

In this chapter we covered wordlists, how to find them, or how to create your own. Wordlists are a major part of password cracking so it is good to master using them. Most modern passwords that you will run into are normally a combination of a name, numbers and symbol(s). I heavily use the Ignis lists when cracking passwords. I use the Hashcat Combinator tool to combine the smaller Ignis lists. The other wordlists I use extensively are the Facebook First and Last name lists. These are wordlists of usernames from a Facebook dump. Both of these are rather large for using the Combinator tool with, but combining them with the smaller Ignis lists or with a numbers lists is also highly effective.

Before we move on to using our wordlists with cracking tools to crack hashes, it’s important to understand what a hash is and what different types of hashes exist. We will cover this in the next chapter!