When I’m building a custom wordlist for a password audit, a plain list of words is almost useless on its own. Real people don’t use “password” — they use “P@ssword123!” or “password2024”. That gap between a raw word and a real-world password is exactly what RSMangler closes. It’s a Ruby-based wordlist mutation tool that takes a seed list (often generated with CeWL) and explodes it into hundreds of realistic variations using leetspeak substitutions, case changes, year appends, and common suffixes.
In this article I’ll walk through what RSMangler actually does under the hood, how to install and run it, the full flag set, and how I fit it into a real password-auditing workflow alongside tools like CeWL, Crunch, and Hashcat.
What RSMangler Is and How It Works Internally
RSMangler is a Ruby script, originally part of the “reconnoitre” style tooling ecosystem, that reimplements and extends the ideas from John the Ripper’s mangling rules in a standalone, scriptable form. Internally it works in three logical stages:
- Ingestion — it reads a plain-text wordlist, one word per line.
- Transformation pipeline — each word is passed through a series of mutation functions: case permutation (upper/lower/title/toggle), leetspeak substitution (
a→4,e→3,o→0,s→$), year and number appending (2023,2024,123,01), common prefix/suffix injection (!,#,_), and word combination (concatenating two words from the list together, e.g.John+Smith→JohnSmith). - Deduplication and output — results are deduplicated and either printed to stdout or written to a file.
Because each stage multiplies the output size, a 50-word seed list can easily balloon into tens of thousands of candidate passwords — which is exactly the point. It mirrors how real users actually mutate base words when a policy forces them to add a digit or symbol.
Installation
RSMangler ships pre-installed on Kali Linux. If it’s missing, or you’re on a different distro:
sudo apt update
sudo apt install rsmangler -y
If it’s not in your repos, install it via RubyGems from source:
git clone https://github.com/stormfront-lab/rsmangler.git
cd rsmangler
gem install rsmangler
Verify installation:
rsmangler --help
Syntax and Core Flags
rsmangler --file <wordlist.txt> [options]
Common flags:
| Flag | Purpose |
|---|---|
-f, --file FILE | Input wordlist |
--max-word-length N | Skip words above this length |
--min-word-length N | Skip words below this length |
-o, --output FILE | Write results to a file instead of stdout |
--no-leet | Disable leetspeak substitution |
--no-years | Disable year appending |
--no-combine | Disable word-combination mode |
--no-common-substitutions | Disable common symbol swaps |
Practical Example
Say I ran CeWL against a target company’s “About Us” page and got a raw list of employee-related words:
cewl https://example-lab.local/about -w seed.txt
seed.txt might contain: Acme, Corporation, Security, Admin, Welcome.
Now I mangle it:
rsmangler -f seed.txt -o mangled.txt
wc -l mangled.txt
Typical output growth: a 5-word seed list can generate several thousand lines in mangled.txt, including entries like Acme2024!, S3curity, Admin_01, WelcomeAcme, 4cmeCorp.
Real-World Use Case (Authorized Lab Only)
In an authorized internal password audit, I typically chain the tools like this:
# Step 1: Harvest organization-specific terms
cewl https://lab-target.local -d 2 -m 5 -w seed.txt
# Step 2: Mutate into realistic password candidates
rsmangler -f seed.txt -o candidates.txt
# Step 3: Feed into offline hash cracking against exported hashes
hashcat -m 1000 ntlm_hashes.txt candidates.txt
This workflow mimics how attackers build targeted, organization-aware wordlists rather than relying on generic dictionaries like rockyou.txt, and it’s a standard technique in authorized red team and password-policy assessments.
Integration and Automation
RSMangler plays well in a pipeline. I often combine it with sort -u to clean duplicates across multiple mangled lists, and with grep to filter by policy-compliant length before handing the list to Hashcat or John the Ripper:
rsmangler -f seed.txt | grep -E '^.{8,}$' | sort -u > final_candidates.txt
Performance and Best Practices
- Keep seed lists focused and specific — mangling a huge generic wordlist creates massive, low-value output.
- Use
--min-word-lengthand--max-word-lengthto avoid noise from very short or very long junk words. - Pipe output through
sort -ubefore cracking to save time on duplicate hash attempts. - Combine with company-specific data: product names, department names, local slang, sports teams — anything scraped from public-facing content.
Common Mistakes
- Running RSMangler on massive dictionaries (like
rockyou.txt) — it’s designed for small, targeted seed lists, not bulk dictionaries. - Forgetting to deduplicate before cracking, wasting compute time.
- Ignoring password policy length/complexity rules when generating candidates, resulting in wasted cracking cycles on non-compliant guesses.
FAQ
Is RSMangler the same as John the Ripper’s rule engine? No, but it’s conceptually similar. John’s rules are applied at crack-time against a wordlist; RSMangler pre-generates a static mutated wordlist you can reuse across multiple tools.
Can I use RSMangler output directly with Hashcat? Yes — the output is a plain text file, one candidate per line, fully compatible with Hashcat’s dictionary attack mode (-a 0).
Does RSMangler work outside Kali? Yes, as long as Ruby and RubyGems are installed, since it’s a Ruby script.
Summary
RSMangler is a small but genuinely useful tool for turning a handful of organization-specific words into a realistic, targeted password candidate list. It’s not a replacement for a good base wordlist — it’s a multiplier that makes the wordlist you already have far more effective. Used responsibly, in authorized password audits, it consistently produces better crack rates than generic dictionaries alone.
References
- Kali Linux Tools Listing: https://www.kali.org/tools/rsmangler/
- RSMangler source (Ruby): available via Kali package repositories (
apt-cache show rsmangler) - Hashcat documentation: https://hashcat.net/wiki/
