> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Username & Password Generation

A generic password wordlist like rockyou.txt works for weak, random users, but targeted lists built from what's actually known about the target (company terms, employee names, site content) consistently outperform it against anyone who followed a password policy. For **Publicly available information:** See the [OSINT](https://0-x.dev/osint.md) page for resources on finding email addresses and exposed credentials.

> **Usernames**
>
> Needed before any login attack even starts, naming conventions are guessable but worth confirming rather than assuming.

> **Passwords**
>
> Built from company/personal context, then mutated with rules to cover realistic variations (capitalization, trailing digits, symbol substitution).

***

## Username Generation

Most organizations use one of a handful of naming conventions (`first.last`, `flast`, `firstl`), generating every variant up saves guessing one at a time. A very useful tool is [username-anarchy](https://github.com/urbanadventurer/username-anarchy):

```bash theme={null}
username-anarchy -i names.txt      # generates every common convention from a list of full names
```

If the target has a LinkedIn presence, pulling real employee names directly beats guessing at naming conventions from nothing. You can use a tool like [linkedin2username.py](https://github.com/initstring/linkedin2username)

```bash theme={null}
python3 linkedin2username.py -c targetco
```

***

## Password Generation

### From Target Specific Context

[CUPP](https://github.com/Mebus/cupp) builds a wordlist interactively from facts about a specific person (name, birthdate, pet, partner), most useful against a single known target account rather than a whole organization.

```bash theme={null}
cupp -i
```

[CeWL](https://github.com/digininja/CeWL) spiders a website and builds a wordlist from the words it actually contains, picking up product names, internal terminology, and employee names that a generic list would never include.

```bash theme={null}
cewl <url> -d 4 -m 6 --lowercase -w company.wordlist
```

### Mutating a Base List with Rules

Real users rarely use a word exactly as written, capitalized first letters, trailing digits, and `@`/`!` substitutions are all common enough to be worth generating up front rather than relying on the cracker to brute-force them live.

```bash theme={null}
hashcat --force company.wordlist -r /usr/share/hashcat/rules/best64.rule --stdout | sort -u > mutated.wordlist
```

> [!NOTE]
>
> See [Password Cracking](https://0-x.dev/password-cracking.md) for the full rule-file breakdown, including when to switch to OneRuleToRuleThemAll for a more thorough pass.

### Combining Two Wordlists

Useful for a known structure like `<word><word>` or `<word><company>`, pairing every entry from one list with every entry from another instead of writing out every combination by hand.

```bash theme={null}
hashcat -a 1 list1.txt list2.txt --stdout > combined.wordlist
```

### Pattern-Based Generation (No Base Wordlist Needed)

When the structure is fully known (a fixed-length PIN, a specific charset) but there's no word to start from at all, [crunch](https://www.kali.org/tools/crunch/) generates every possible string directly from a pattern.

```bash theme={null}
crunch 6 8 -t Summer%%@@ -o custom.wordlist   # 6-8 chars, %=digit, @=lowercase letter, fixed "Summer" prefix
```

***

## Quick Reference Tools

> **[CUPP](https://github.com/Mebus/cupp)**
>
> Interactive, profile-based wordlist generation for a specific target.

> **[CeWL](https://github.com/digininja/CeWL)**
>
> Builds a wordlist from a website's own content.

> **[username-anarchy](https://github.com/urbanadventurer/username-anarchy)**
>
> Generates every common username convention from a name list.

> **[linkedin2username](https://github.com/initstring/linkedin2username)**
>
> Pulls real employee names from a company's LinkedIn presence.

> **[crunch](https://www.kali.org/tools/crunch/)**
>
> Generates every possible string from a pattern, no base wordlist needed.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.