Wordlists: The Unsung Foundation of Every Password Cracking Attack

Every cracking tool I’ve covered elsewhere in this series — aircrack-ng, hashcat, John the Ripper — is ultimately only as good as the wordlist you feed it. I’ve seen people spend hours optimizing GPU cracking rigs and then run the attack against a generic list that was never going to contain the target password in the first place. Wordlists don’t get the same attention as the flashy attack tools, but understanding how to choose, generate, and customize them is genuinely one of the highest-leverage skills in password security testing.

This article covers what wordlists actually are, the well-known pre-compiled lists you’ll run into constantly, how to install and manage them, how to generate your own targeted lists, and how they plug into the rest of your toolkit.

What Are Wordlists?

A wordlist (or dictionary) is simply a text file containing candidate passwords, one per line, used as input to a dictionary attack. Instead of brute-forcing every possible character combination (which is computationally infeasible for anything beyond short passwords), a dictionary attack tests real-world, human-chosen passwords — which cluster heavily around predictable patterns: common words, keyboard walks, names, dates, and known leaked passwords reused across services.

Wordlists power dictionary attacks against:

• WPA/WPA2 handshakes (via aircrack-ng or hashcat).
• Hashed password databases (via hashcat or John the Ripper).
• Login brute-forcing tools (via Hydra or similar, in authorized testing only).
• WPS PIN databases (some tools support checking known default PINs by router model).

How Wordlist Attacks Work Internally

For hash-based cracking, the process is straightforward: the tool takes each candidate password from the wordlist, applies the same hashing/key-derivation function the target system used (MD5, SHA family, bcrypt, PBKDF2 for WPA2, etc.), and compares the result against the captured hash. A match means the password is recovered.

For WPA2 specifically, this is computationally expensive because PBKDF2 with the SSID as a salt requires thousands of hashing rounds per candidate — which is precisely why wordlist quality and targeting matter so much more than raw list size. A well-targeted 10,000-word list beats a generic untargeted 10-million-word list for the majority of real-world passwords.

The Most Common Pre-Compiled Wordlists

rockyou.txt

The single most referenced wordlist in the security community, originally sourced from a 2009 breach of the RockYou website, containing roughly 14 million real-world passwords. It’s included by default on Kali Linux (compressed):

ls /usr/share/wordlists/

Output:

rockyou.txt.gz

Decompress it before use:

sudo gunzip /usr/share/wordlists/rockyou.txt.gz

Confirm:

wc -l /usr/share/wordlists/rockyou.txt

Expected output:

14344391 /usr/share/wordlists/rockyou.txt

SecLists

A far larger, actively maintained collection covering passwords, usernames, fuzzing payloads, and more — maintained by the security community on GitHub.

sudo apt install seclists -y

Or clone directly:

git clone https://github.com/danielmiessler/SecLists.git

Browse the password-specific lists:

ls SecLists/Passwords/

Output includes directories like:

Common-Credentials/
Default-Credentials/
Leaked-Databases/
WiFi-WPA/

The WiFi-WPA/probable-v2-wpa-top4800.txt list, for example, is specifically curated for WPA2 passphrase cracking and often outperforms rockyou.txt for that specific use case since it’s focused on router-default and common Wi-Fi password patterns.

Installing and Managing Wordlists

On Kali, most standard lists live under /usr/share/wordlists/:

ls /usr/share/wordlists/

Typical output:

dirb/
dirbuster/
fasttrack.txt
metasploit/
nmap.lst
rockyou.txt.gz
wifite.txt

Keep your working set organized in a dedicated directory for custom or downloaded lists:

mkdir -p ~/wordlists
cd ~/wordlists

Generating Custom Wordlists

Pre-compiled lists are a great starting point, but targeted engagements almost always benefit from a custom list built around the actual target.

Using crunch for Pattern-Based Generation

crunch generates every possible combination matching a pattern — useful when you know something about the password structure (e.g., an 8-digit numeric WPS-style PIN, or a company naming convention):

sudo apt install crunch -y
crunch 8 8 0123456789 -o numeric8.txt

This generates all 8-digit numeric combinations. Output file size warning appears first:

Crunch will now generate the following amount of data: 900000000 bytes
0 MB
0 GB
0 TB
0 PB
Crunch will now generate the following number of lines: 100000000

Using cewl to Scrape Target-Specific Words

cewl crawls a website and builds a wordlist from the words it finds — genuinely effective for corporate password guessing, since employees often base passwords on company terminology, product names, or founder names:

sudo apt install cewl -y
cewl https://example-lab-target.local -d 2 -m 5 -w company_words.txt

Flags:

• -d 2 — crawl depth of 2 links.
• -m 5 — minimum word length of 5 characters.
• -w — output file.

Combining and Mutating Lists With hashcat Rules

Rather than generating brand-new lists from scratch, applying mutation rules to an existing list (appending numbers, capitalizing first letters, common leetspeak substitutions) dramatically increases coverage without the combinatorial explosion of pure brute-force:

hashcat -r /usr/share/hashcat/rules/best64.rule --stdout rockyou.txt > mutated_rockyou.txt

Real-World Use Cases (Authorized Testing Only)

1. WPA2 Passphrase Recovery Feeding a targeted list like SecLists’ WiFi-WPA collection into aircrack-ng or hashcat against a captured handshake, as covered in the aircrack-ng article, is where wordlist quality has the single biggest impact on success rate.

2. Corporate Password Audits During authorized internal password audits (testing whether employees’ hashed passwords, obtained with proper authorization from an Active Directory dump, are crackable), combining rockyou.txt with a cewl-generated company-specific list consistently recovers a meaningful percentage of weak passwords.

3. Default Credential Checks SecLists’ Default-Credentials directory is invaluable when auditing IoT devices, routers, and admin panels for unchanged factory-default logins — a shockingly common finding in real assessments.

Workflow and Tool Integration

• aircrack-ng / hashcat — primary consumers of wordlists for WPA2 cracking.
• John the Ripper — supports the same wordlist files, plus its own built-in mangling rules.
• Hydra — uses wordlists for authorized online brute-force testing against login forms and services.
• crunch / cewl — for generating and customizing lists before feeding them into the cracking tools above.

Performance Optimization

• Sort and deduplicate large combined lists before use to avoid wasting cycles on repeated candidates: sort -u rockyou.txt seclists_passwords.txt > combined_unique.txt
• For GPU-accelerated cracking, pipe rule-mutated wordlists directly into hashcat rather than pre-generating enormous static files that eat disk space.
• Prioritize smaller, targeted lists first (fast to exhaust, often high hit-rate) before falling back to exhaustive generic lists like the full rockyou.txt.

Troubleshooting

• “No such file or directory” for rockyou.txt: remember it ships compressed on Kali — run gunzip first.
• Wordlist attack running extremely slowly: check whether you’re accidentally running a CPU-bound tool (aircrack-ng) against a multi-million-line list when a GPU-based hashcat run would be dramatically faster.
• crunch generating unexpectedly huge files: always check the size estimate crunch prints before confirming generation — patterns grow combinatorially fast.

Common Mistakes

• Defaulting to rockyou.txt for every task without considering more targeted, purpose-built lists (like SecLists’ WiFi-specific collections) that often perform better for a specific attack type.
• Generating enormous crunch wordlists without checking the size estimate first, filling up disk space unexpectedly.
• Using wordlists to test password strength or crack credentials without proper authorization — the tool is neutral, but its use against systems you don’t own or have permission to test is illegal in most jurisdictions.

Best Practices

• Match the wordlist to the target: use WiFi-specific lists for WPA2 work, corporate-scraped lists for internal audits, and default-credential lists for IoT/device audits.
• Apply mutation rules (hashcat rules like best64.rule or rockyou-30000.rule) to multiply the effective coverage of a modest base list before resorting to exhaustive brute-force.
• Keep your wordlist collection organized and versioned — SecLists in particular updates regularly on GitHub, so periodically pull the latest changes.
• Always deduplicate and sort combined lists to avoid wasted cracking cycles.

Practical Lab Example

1. Set up a test WPA2 network with a password like Summer2026! (a common human-pattern password).
2. Generate a mutated wordlist: hashcat -r best64.rule --stdout /usr/share/wordlists/rockyou.txt > mutated.txt.
3. Capture a handshake from your own test AP using the process described in the aircrack-ng article.
4. Run aircrack-ng -w mutated.txt -b <bssid> handshake-01.cap and confirm the mutated list recovers the password where the base rockyou.txt alone might not.
5. Compare timing and success against a cewl-scraped list built from a page containing “Summer” and similar seasonal terms.

FAQ

Where does rockyou.txt come from? It originates from a 2009 data breach of the RockYou social media application platform, and has since become the de facto standard reference wordlist in security testing due to its size and real-world password diversity.

Is a bigger wordlist always better? No — a larger list takes longer to exhaust and a smaller, well-targeted list (based on the specific attack type or organization) often has a higher hit rate per unit of time spent.

Are wordlists themselves illegal to possess? No — they’re just text files of common passwords, widely used for legitimate security research, auditing, and defense. Using them against systems without authorization is what’s illegal, not possessing the list.

What’s the difference between a wordlist attack and brute-force? A wordlist attack only tries real, likely candidate passwords; true brute-force tries every possible character combination, which is vastly slower and often computationally infeasible for anything beyond short passwords.

Summary

Wordlists are the quiet foundation underneath nearly every password and passphrase cracking tool covered in this series — aircrack-ng, hashcat, John the Ripper, and beyond. Spending time understanding, curating, and generating targeted wordlists, rather than defaulting to the same generic list every time, is consistently one of the highest-value skills you can build in offensive security testing.

References

• SecLists GitHub repository: https://github.com/danielmiessler/SecLists
• RockYou wordlist background and mirrors: https://github.com/brannondorsey/naive-hashcat/releases (commonly referenced mirror)
• crunch documentation: https://sourceforge.net/projects/crunch-wordlist/
• cewl GitHub repository: https://github.com/digininja/CeWL
• hashcat rules documentation: https://hashcat.net/wiki/doku.php?id=rule_based_attack