Generate custom wordlist#

Cracking passwords is good to know.

If we are able to do a dictionary-attack against a service it is important that we use a good dictionary. We can use e generic one. But we can also generate a custom wordlist based on certain criteria. That is what we are going to do in this chapter.

Remember people often use their birth dates, address, street address, pets, family members, etc.

Who is the target?#

The target might be a specific company or person.

Password rules#

The service you want to hack might have specific password rules. Must contain certain characters, must be of certain length etc.

Combine a small/semi-small dict with a custom#

To combine two wordlists you can just do

cat wordlist.txt >> wordlist2.txt

Create a custom wordlist#

Html2dic - Build dictionary from html

You can build a dictionary from a html-page.

curl http://example.com > example.txt

Then run:

html2dic example.txt

Then you should probably remove duplicates.

Cewl - Spider and build dictionary

cewl -w createWordlist.txt https://www.example.com 

Add minimum password length:

cewl -w createWordlist.txt -m 6 https://www.example.com 

Improve the custom wordlist

As we all know few password are just simple words. Many use numbers and special characters. To improve our password list we can use john the ripper. We can input our own rules, or we can just use the standard john-the-ripper rules

john ---wordlist=wordlist.txt --rules --stdout > wordlist-modified.txt

References#

http://null-byte.wonderhowto.com/how-to/hack-like-pro-crack-passwords-part-4-creating-custom-wordlist-with-crunch-0156817/