🔐 Password Mutations & Wordlist Generation
Last updated
Last updated
Despite system-enforced password policies, users tend to choose simple and predictable passwords. This is due to:
Preference for convenience over security.
Predictable patterns (e.g., names, pets, company name, hobbies).
OSINT (Open-Source Intelligence) can help attackers guess passwords by learning user preferences.
➡️ Learn more in the module.
Most systems enforce rules like:
First letter is uppercase
Password
Adding numbers
Password123
Adding a year
Password2022
Adding a month
Password02
Ending with an exclamation mark
Password2022!
Using special characters
P@ssw0rd2022!
📏 Most passwords are ≤10 characters (per WP Engine stats).
Start with familiar terms (≥5 characters):
Pet names
Hobbies
Favorite teams
Months, seasons, etc.
Add mutations to meet complexity:
Year
Special character
Capitalization
📌 Example (from a list with just one entry password):
Hashcat allows custom rule-based password generation.
🔧 Basic Syntax for Rules
:
Do nothing
l
Lowercase all letters
u
Uppercase all letters
c
Capitalize first letter
sXY
Replace character X with Y
$!
Add exclamation mark at the end
📁 Custom Rule File (custom.rule)
🔁 Each word from password.list gets mutated 15 times.
📄 Sample Output (mut_password.list)
Hashcat comes with a number of pre-defined rules:
📁 Location: /usr/share/hashcat/rules/
📌 Popular Rules Include:
best64.rule ✅
rockyou-30000.rule
dive.rule
InsidePro-HashManager.rule
unix-ninja-leetspeak.rule
...and many more
CeWL scrapes words from websites to generate custom wordlists.
📘 Example:
🔢 Count entries:
📌 Combine this with Hashcat rules for targeted and effective password guessing.
✅ Use common patterns and user interests. ✅ Leverage Hashcat mutation rules and CeWL for web-based term extraction. ✅ Build targeted, compact wordlists to improve password cracking efficiency.
🔗 Learn more in