Skip to main content
A generic password wordlist like rockyou.txt works for weak, random users, but targeted lists built from what’s actually known about the target (company terms, employee names, site content) consistently outperform it against anyone who followed a password policy. For Publicly available information: See the OSINT page for resources on finding email addresses and exposed credentials.

Usernames

Needed before any login attack even starts, naming conventions are guessable but worth confirming rather than assuming.

Passwords

Built from company/personal context, then mutated with rules to cover realistic variations (capitalization, trailing digits, symbol substitution).

​
Username Generation

Most organizations use one of a handful of naming conventions (first.last, flast, firstl), generating every variant up saves guessing one at a time. A very useful tool is username-anarchy:
If the target has a LinkedIn presence, pulling real employee names directly beats guessing at naming conventions from nothing. You can use a tool like linkedin2username.py

​
Password Generation

​
From Target Specific Context

CUPP builds a wordlist interactively from facts about a specific person (name, birthdate, pet, partner), most useful against a single known target account rather than a whole organization.
CeWL spiders a website and builds a wordlist from the words it actually contains, picking up product names, internal terminology, and employee names that a generic list would never include.

​
Mutating a Base List with Rules

Real users rarely use a word exactly as written, capitalized first letters, trailing digits, and @/! substitutions are all common enough to be worth generating up front rather than relying on the cracker to brute-force them live.
See Password Cracking for the full rule-file breakdown, including when to switch to OneRuleToRuleThemAll for a more thorough pass.

​
Combining Two Wordlists

Useful for a known structure like <word><word> or <word><company>, pairing every entry from one list with every entry from another instead of writing out every combination by hand.

​
Pattern-Based Generation (No Base Wordlist Needed)

When the structure is fully known (a fixed-length PIN, a specific charset) but there’s no word to start from at all, crunch generates every possible string directly from a pattern.

​
Quick Reference Tools

CUPP

Interactive, profile-based wordlist generation for a specific target.

CeWL

Builds a wordlist from a website’s own content.

username-anarchy

Generates every common username convention from a name list.

linkedin2username

Pulls real employee names from a company’s LinkedIn presence.

crunch

Generates every possible string from a pattern, no base wordlist needed.