Imagine you’re performing a penetration test on a client’s website. Your job is to find potential weak points in their security. After running some basic scans, you notice that the login form looks vulnerable.

It lacks rate limiting and strong password protections. So, you might be able to try multiple passwords without being locked out. This is where a wordlist comes into play.

Instead of guessing random passwords one by one, you can use a pre-made wordlist. The list will contain thousands or even millions of potential passwords.

You can combine this wordlist with a brute-force tool like Hydra to perform an attack. The tool goes through the wordlist, testing each password against the login form. After a while, you hit a match. You’ve just cracked the login.

As an ethical hacker, you would notify the client of the weak password policy. You can then suggest stronger security measures to avoid this scenario. But this shows how critical wordlists can be when it comes to exploiting weak login systems.

In this article will look at wordlists in detail. We’ll cover what they are and a few use cases along with some popular wordlists.

What are Wordlists?

Wordlists are exactly what they sound like: lists of words. In cybersecurity, these words represent passwords, usernames, or even URLs.

Wordlists can be simple collections of common passwords like “123456” or “password”. Or they can be custom lists generated to target specific systems.

Penetration testers feed these wordlists into tools to test multiple inputs quickly. These tools include password-cracking software, brute-forcing scripts, or directory scanners. The wordlist acts as the source of input, trying each word against the target in an attempt to find a match.

How are Wordlists used?

Let’s look at a few common scenarios where wordlists can be useful.

Password Cracking

One of the most common uses of wordlists is password cracking. Attackers feed a wordlist into tools like John the Ripper or Hashcat. These tools then test each word against a password hash to find a match.

Let’s assume that a hacker finds hashed passwords from a compromised database. They can use a wordlist to attempt to reverse those hashes into the original passwords.

Modern security practices encourage complex passwords. But many people still use weak, common passwords. Wordlists exploit this human tendency by including frequently used passwords.

One of the most famous password wordlists in the hacking community is Rockyou.txt. It has 14 million passwords collected after the site Rockyou.com was breached by hackers. Here is the full wordlist.

Username Enumeration

In some systems, knowing the correct username is half the battle. Hackers often use wordlists to enumerate usernames before attempting a password attack. It works by submitting different usernames to a login form and watching the system’s response.

For example, some systems will return an error message like “Username not found”. A well-crafted wordlist of usernames allows you to quickly discover which accounts exist.

A username wordlist would help in this type of scenario. It doesn’t have to be long like a password wordlist. But a list of common usernames would help. Here is one such wordlist.

Directory and File Enumeration

When testing a web app, it’s important to find hidden files and directories. They may not be publicly listed. Finding these hidden URLs that may reveal sensitive information or hidden functionality.

Tools like Gobuster or Dirbuster use wordlists to automate this process. They try each word in the wordlist as a potential directory or file name.

For example, testing a wordlist on a website could find a hidden admin panel at /admin or a backup file at /backup.zip. This can be useful for finding unintended exposures.

Here is a sample directory wordlist.

Subdomain Enumeration

Subdomain enumeration involves finding all the subdomains associated with a target website. Like hidden pages, subdomains can also contain useful and sensitive information.

For example, a product at product.com can contain a development server at dev.product.com. Or an admin panel at admin.product.com. These subdomains might not be well protected like the main website.

Tools like Sublist3r and Amass are popular for this task. Here is a subdomain wordlist for these types of attacks.

Creating Custom Wordlists

Sometimes, general wordlists aren’t enough. For specific engagements, it’s worth creating your own wordlist tailored to the target. For example, if you’re pentesting for a company, you might build a custom wordlist for that company. It can have employee names, department names, or relevant terms unique to that company.

Several tools help you create custom wordlists.

• CeWL (custom wordlist generator) — generates wordlists by scraping text from a website specific to the target.

• Crunch — creates wordlists by mixing and matching the characters that you provide.

Conclusion

Wordlists are powerful tools that every cybersecurity professional should have in their arsenal. They simplify complex tasks like password cracking, brute-forcing, and directory enumeration. The right wordlist can save you hours and help you find vulnerabilities quickly and efficiently.

To learn how to build a career in Cybersecurity, check out The Hacker’s Handbook. To practice hacking real systems and get help from other hackers, join The Hacker’s Hub.