Wordlists and Rules

Cracking is a guessing game, and a wordlist is your list of guesses. The quality of the list decides whether you crack a hash in seconds or never. Raw brute force (every possible character combination) is hopeless past a few characters, so real attacks lean on human predictability instead.

rockyou and friends

The most famous wordlist is rockyou.txt, roughly 14 million real passwords leaked from a 2009 breach. It ships with Kali and lives under /usr/share/wordlists/. Because it is made of passwords humans actually chose, it cracks a shocking number of weak hashes on its own.

Beyond rockyou, the SecLists project bundles curated lists by category: common passwords, default credentials, and leaked corporate sets. Bigger is not always better. A focused list that matches your target beats a giant generic one.

Build a custom list from target intel

Passwords reflect the people who make them. A company named Acme in Denver will have accounts using Acme2024, Denver!, and Broncos1. Tools like cewl scrape a target website and turn its words into a candidate list.

$cewl -d 2 -m 5 -w custom.txt https://target.example

Rules: one word becomes hundreds

A raw word like password is rarely the actual password. People capitalize, append years, and swap letters for symbols. Rule-based mutation applies these transformations automatically, so one base word expands into many candidates: password, Password, Password1, P@ssw0rd, password2024.

Hashcat ships rule files under /usr/share/hashcat/rules/. The best64.rule set is the standard starting point: 64 high-value mutations that catch most human habits without exploding your runtime.