Password Cracking and Wordlist Engineering Part 4: Building Wordlists That Actually Work

Parts 2 and 3 covered the engines. This post covers the fuel. hashcat at 288.5 GH/s and John’s --single mode are both irrelevant if the wordlist being fed to them doesn’t contain anything close to the real password — and B4ckup$SQL2024, the password Part 4 of the Impacket series actually cracked, is nowhere in rockyou.txt. It’s a pattern: a capitalized word related to the account’s function, a special character, a related word, a year. Getting that pattern — not a bigger static file — is what this post is about.

rockyou.txt: what it actually is, and where it stops being enough

rockyou.txt is 14,344,391 unique real passwords, deduplicated from a genuine 2009 breach of RockYou’s user database. It’s the default first wordlist for a reason: it’s real human password-choice behavior at enormous scale, and it wins fast, easy cracks constantly — reused passwords, common phrases, the classics. Every part of this series so far has used it as the baseline.

Its limits are exactly what its origin implies: it’s fourteen-year-old, mostly-English, mostly-Western consumer password behavior from a social-media-adjacent site. It has essentially no representation of anything organization-specific — no service-account naming conventions, no company names, no product names, no the specific year a specific system went into production. svc-backup’s actual password combines a role-descriptive word (Backup), a related technical term (SQL), a special character, and a year (2024) — a pattern, not a dictionary word, and no static wordlist file will ever contain the specific instance of that pattern for a specific organization. Reproducing the pattern is the job; rockyou was never going to do it alone.

crunch: generating candidates from a pattern, not a leak

crunch builds wordlists from explicit rules rather than real breach data — the tool for exactly the “pattern, not dictionary word” problem above. Verified against the installed crunch 3.6 man page rather than an older cheat sheet, its core syntax is crunch <min-len> <max-len> [charset] [options]:

$ crunch 8 12 -t Sc4nn3r%%%%

That -t pattern flag is the useful one: @ inserts lowercase, , inserts uppercase, % inserts a digit, ^ inserts a symbol — everything else in the pattern string is a literal. -t Sc4nn3r%%%% holds the leetspeak-mangled word Sc4nn3r fixed and generates every 4-digit suffix from 0000 to 9999 — exactly the shape of Sc4nn3r2019!, the password Part 3 of the Impacket series actually cracked off svc-legacy-scan. A generic wordlist attack finds that password by luck; a targeted mask built from the account’s own naming convention finds it by design.

Other verified crunch flags worth knowing: -o wordlist.txt writes to a file instead of stdout, -d 2@ caps consecutive repeated characters (useful for keeping candidate counts sane), and -p word1 word2 ... switches to permutation mode — every ordering of a fixed set of words, no repeats, useful for testing whether a password is some rearrangement of a known set of terms (company name, department, year) rather than a fixed concatenation.

cewl: building a wordlist from the target’s own words

cewl (Custom Word List generator) spiders a URL and returns the words it finds — the tool for building a wordlist out of an organization’s own language rather than guessing at it. Verified against the installed cewl 5.5.2 man page:

$ cewl -d 2 -m 5 --with-numbers -w contoso-words.txt https://www.contoso-example.local

-d 2 sets crawl depth, -m 5 discards words shorter than 5 characters (cuts noise fast), --with-numbers keeps alphanumeric tokens like product codes or years instead of filtering them out, and -w writes the result to a file. -g additionally returns word groups — pairs and triples of adjacent words, useful for catching multi-word phrases used as passphrases rather than single terms. Pointed at a company’s own public site — careers page, press releases, product pages — cewl returns exactly the vocabulary an employee at that company is statistically likely to draw on when asked to pick a password: product names, internal project names, department names, the CEO’s name from an about-us page.

Combining, cleaning, and not trusting either tool blindly

Neither crunch output nor cewl output is useful raw. Standard cleanup, all standard Unix text tools rather than anything specialized:

$ cat rockyou.txt contoso-words.txt custom-patterns.txt | sort -u > combined.txt
$ wc -l combined.txt

sort -u deduplicates across every source in one pass — critical once rockyou, a cewl scrape, and a crunch-generated pattern list are all feeding the same attack, since duplicate candidates are pure wasted GPU time at NTLM’s 288.5 GH/s and genuinely material wasted time at Kerberoast’s ~3.5 GH/s. It’s also worth sanity-checking candidate count before committing GPU hours to a run — crunch’s own output includes an estimated line count and file size before it starts generating, and running wc -l on a finished cewl scrape takes a second and catches an empty or near-empty result (a JS-rendered site cewl can’t see into, for instance) before it silently wastes an attack run on a wordlist with nothing useful in it.

What this sets up

A combined wordlist — rockyou for baseline coverage, a cewl scrape for the organization’s actual vocabulary, crunch-generated patterns for the naming conventions service accounts tend to follow — is still just a list of whole candidate strings. It doesn’t yet know that Summer2026!, Summer2027!, and Fall2026! are all the same underlying human behavior with one token swapped. That’s what rules exist to express, and Part 5 is entirely about hashcat’s rule engine: best64.rule, what its 102 lines actually do, and writing custom rules instead of only downloading someone else’s.