Dictionary Attacks: Wordlist-Based Password Cracking

The 14 Million Passwords That Cracked Everything

In 2009, the social gaming company RockYou stored 32 million user passwords in plaintext. When hackers breached the database, they walked away with 14.3 million unique passwords — "123456," "password," "qwerty," and thousands of other real passwords people actually used. This leaked dataset became the Rosetta Stone of password cracking, and the RockYou wordlist remains the starting point for dictionary attacks today.

A dictionary attack is a password cracking technique that uses a pre-compiled list of words (a wordlist) to guess passwords. Unlike pure brute force which tries every possible combination, dictionary attacks are far more efficient because they target the most commonly used passwords.

Prerequisites

Before studying dictionary attacks, you should understand:

Why Dictionary Attacks Work

Studies consistently show that the most common passwords are dictionary words, names, and simple patterns:

# Top 10 most common passwords (2025-2026)
1. 123456
2. password
3. qwerty
4. admin
5. letmein
6. welcome
7. monkey
8. sunshine
9. master
10. 123456789

Essential Wordlists

Built-in GO KALI Wordlists

# RockYou (most famous wordlist)
ls -la /usr/share/wordlists/rockyou.txt.gz
# 14 million passwords from the 2009 RockYou breach
# Extract: gunzip /usr/share/wordlists/rockyou.txt.gz

# SecLists (comprehensive collection)
ls /usr/share/seclists/Passwords/

# Common passwords
/usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt

# Leaked passwords collection
/usr/share/seclists/Passwords/Leaked-Databases/

# Default credentials
/usr/share/seclists/Passwords/Default-Credentials/

Specialized Wordlists

# Keyboard walks
# qwerty, asdfgh, zxcvbn, 1qaz2wsx

# Leet speak conversions
# p@ssw0rd, 5ecur1ty, h4ck3r

# Date combinations
# 1990-2026, 0101-1231

# Sports teams
# yankees, lakers, patriots, redsox

# Pop culture
# starwars, harrypotter, twilight, avengers

Creating Custom Wordlists

Using Crunch (Pattern-Based)

# Generate all 8-char lowercase passwords
crunch 8 8 abcdefghijklmnopqrstuvwxyz -o 8char.txt

# Generate with pattern (prefix + 4 digits)
crunch 8 8 -t pass@@@@ -o pass_words.txt

# Year-based passwords
crunch 10 10 -t Welcome@@@ -o welcome_words.txt

# Company email pattern
# Example: "KaliGo" variations
crunch 6 10 -p KaliGo kaligo KALIGO KaliGo1 KALIGO1

Using CeWL (Website Scraping)

# Generate wordlist from a website
cewl https://target.com -w target_words.txt

# Min/max word length
cewl -m 5 -w words.txt https://target.com

# Include meta data
cewl --meta -w words.txt https://target.com

# Follow links (depth)
cewl -d 2 -w deeper_words.txt https://target.com

Using KWProcessor (Keyboard Walks)

# Generate keyboard walk patterns
kwp -s 1 -o keyboard_walks.txt

# Base64 encode output
kwp -s 1 | base64 > encoded_walks.txt

Using Custom Scripts

#!/usr/bin/env python3
# generate-wordlist.py — Create targeted wordlist

import itertools
import sys

def generate_wordlist(base_words, numbers=True, special=True, years=True):
    words = set()

    for word in base_words:
        words.add(word)
        words.add(word.lower())
        words.add(word.upper())
        words.add(word.capitalize())

        # Append numbers
        if numbers:
            for i in range(100):
                words.add(f"{word}{i:02d}")

        # Append years
        if years:
            for year in range(1990, 2027):
                words.add(f"{word}{year}")

        # Add special chars
        if special:
            words.add(f"{word}!")
            words.add(f"{word}@")
            words.add(f"{word}#")
            words.add(f"{word}
quot;)

        # Leet speak
        leet = str.maketrans('aeiost', '43105t')
        words.add(word.translate(leet))

    return words

if __name__ == "__main__":
    base = ['admin', 'password', 'welcome', 'summer', 'company', 'security']
    wordlist = generate_wordlist(base)
    for word in sorted(wordlist):
        print(word)

Wordlist Management

Merging and Deduplicating

# Merge multiple wordlists
cat wordlist1.txt wordlist2.txt > combined.txt

# Deduplicate
sort -u combined.txt > unique.txt

# Count unique words
wc -l unique.txt

# Filter by length
awk 'length($0) >= 8 && length($0) <= 16' wordlist.txt > filtered.txt

Wordlist Analysis

# Find most common patterns
sort wordlist.txt | uniq -c | sort -rn | head -20

# Find longest words
awk '{ print length, $0 }' wordlist.txt | sort -rn | head -10

# Find shortest words
awk '{ print length, $0 }' wordlist.txt | sort -n | head -10

# Character distribution
fold -w1 wordlist.txt | sort | uniq -c | sort -rn | head -20

Optimizing Dictionary Attacks

With Rules

Rules multiply wordlist effectiveness by generating variations of each word:

# Hashcat with best64 rules
hashcat -m 1000 ntlm.txt rockyou.txt -r best64.rule

# John with rules
john --wordlist=rockyou.txt --rules hashes.txt

# Common rule patterns:
# c$d$d$d — Capitalize + append 3 digits
# s@a s0o s$s — Leet speak substitutions
# l — Lowercase all
# u — Uppercase all

Markov-Based Attacks

# Hashcat Markov generator
hashcat --markov-disable  # Disable Markov (default)
hashcat --markov-classic   # Use Markov mode

# John's incremental mode uses Markov chains
john --incremental hashes.txt

Real-World Examples

RockYou Breach (2009): 32 million passwords leaked from RockYou. The wordlist has become the universal starting point for dictionary attacks, containing 14.3 million unique passwords.

LinkedIn Breach (2012): 6.5 million unsalted SHA-1 hashes cracked quickly using dictionary attacks because passwords lacked salts.

Ashley Madison (2015): Despite using bcrypt, attackers cracked millions of passwords using targeted dictionary attacks based on common patterns.

Common Mistakes

Not enough words: A small wordlist misses many passwords. Use comprehensive wordlists.

Not using rules: Plain dictionary attacks are far less effective than rule-based attacks.

Default wordlists only: RockYou is a starting point. Supplement with custom and targeted wordlists.

No deduplication: Duplicate entries waste processing time.

Best Practices

Related Tools

Related Articles

Summary

Dictionary attacks use wordlists of common passwords and their variations. They are far more efficient than pure brute force because they target real-world password patterns. Success depends on wordlist quality, rule effectiveness, and understanding the target's password creation habits.

Knowledge Check