Ethical Hacking Academy · Lesson

Wordlists and Rules

Building dictionaries.

Wordlists and Rules is a free Ethical Hacking Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Wordlists Matter

Most passwords are not random — people reuse common words, patterns, and substitutions. A wordlist (dictionary) is a file of candidate passwords. Quality wordlists are the single biggest factor in cracking success for human-chosen passwords.

Classic Wordlists

The most famous wordlist is rockyou.txt, leaked from a 2009 breach of 32 million real passwords. It ships with Kali. The SecLists project bundles many curated lists for passwords, usernames, and fuzzing.

/usr/share/wordlists/rockyou.txt
/usr/share/seclists/Passwords/

Targeted Wordlists with CeWL

Generic lists miss organization-specific words. CeWL spiders a target website and harvests words from its pages to build a custom wordlist tuned to that company's jargon, products, and names.

cewl -d 2 -m 5 -w custom.txt https://target.local

Profiling with CUPP

CUPP (Common User Passwords Profiler) builds personalized candidates from facts about a target — name, partner, pet, birthdate — combining and mutating them the way people actually form passwords.

cupp -i
# answer prompts: name, nickname, birthdate, pet...

What Are Rules?

Instead of storing every variation, rules transform each base word on the fly: capitalize, append digits, swap letters for symbols. One word plus rules can expand into thousands of realistic candidates.

Common Rule Operations

Typical mutations mirror human habits:

Capitalize first letter: password → Password
Append year: Password2024
Leet substitution: P@ssw0rd
Append ! at end

Hashcat Rule Syntax

Hashcat rules use single-character functions. c capitalizes, $X appends X, sa@ swaps a→@. Rules live in .rule files, one rule per line.

c $2 $0 $2 $4
sa@ ss$ c
# capitalize, append 2024 / leet-swap+capitalize

Built-in Rule Files

Hashcat ships powerful rule sets in its rules/ folder. best64.rule is a fast, high-yield set; dive.rule and OneRuleToRuleThemAll are larger and more thorough but slower.

/usr/share/hashcat/rules/best64.rule
/usr/share/hashcat/rules/dive.rule

Combining Wordlists and Rules

The winning combo is a good wordlist plus a rule set: realistic base words multiplied by realistic mutations. This dramatically outperforms brute force for human passwords while staying far smaller than exhaustive search.

hashcat -m 0 -a 0 hashes.txt rockyou.txt -r best64.rule

Word Mangling Trade-offs

More rules = more candidates = more time. A huge rule file can turn a 14-million-word list into billions of guesses. Balance coverage against your time budget and the hash algorithm's speed.

Ethics and Authorization

Building targeted wordlists from a person's social media is reconnaissance and must be authorized. Crack only hashes you are permitted to test (your own systems or an engagement with written consent). Misuse is a crime.

Quick Check

Test your wordlist knowledge.

Recap

You learned how to build cracking dictionaries:

rockyou.txt and SecLists are staple wordlists
CeWL scrapes sites; CUPP profiles individuals
Rules mutate words (capitalize, append, leet) — e.g. best64.rule
Combine list + rules for the best human-password coverage

Next: GPU cracking with Hashcat.

Frequently asked questions

Is the “Wordlists and Rules” lesson free?

Yes — the full text of “Wordlists and Rules” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Wordlists and Rules”?

Building dictionaries. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Wordlists and Rules” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Ethical Hacking Academy