level up your wordlists past rockyou

rockyou.txt is the wordlist everyone starts with because it's basically free and it's baked into every kali install. but here's the thing, every attacker on earth has the same file. if your password policy only protects against rockyou, you're protected against nothing. this post walks through the tools that come after rockyou, not so you can go crack accounts that aren't yours, but so you understand exactly how someone would attack your own passwords and where to actually plug the holes.

why rockyou alone gives you a false sense of security

rockyou.txt is a leaked password dump from 2009. it's huge, it's got real human passwords in it, and it's a great baseline. but it's also old and generic. it doesn't know your company name, your product names, your local sports team, or the season and year your it department loves to slap onto a "temporary" password. if you're testing your own org's password strength and only throwing rockyou at it, you're testing against a decade-old average internet user, not against someone who actually knows something about you.

seclists: the library you should be pulling from instead

seclists is a massive, organized collection of wordlists for basically every use case, passwords, usernames, fuzzing payloads, subdomains, you name it. instead of one giant undifferentiated file, you get lists broken down by relevance, like top passwords by breach, common corporate passwords, default credentials for specific devices, and more.

git clone https://github.com/danielmiessler/SecLists.git

as a defender, this is genuinely useful to keep around. run your own password hashes (from your own systems, with authorization) against the default-credentials lists to make sure nobody left a router or app on out-of-the-box logins. that single check catches an embarrassing amount of real-world exposure.

cewl: seeing your own site the way an attacker would

cewl scrapes a website and builds a custom wordlist out of the words it finds there, things like product names, employee names, jargon, and branding that show up over and over. the command from the reel:

cewl https://your-own-domain.com

breaking it down: cewl is the tool, and the url is the target it crawls. it pulls text from pages, filters out noise, and spits out a list of words ranked by frequency. an attacker would use this to guess that your employees are reusing your product name plus a year as a password. as a defender, you should run this against your own public site and see what pops out. if your wordlist comes back full of your company slogan, your ceo's name, or your flagship product, that tells you exactly what to ban in your password policy.

cewl https://your-own-domain.com -w custom_wordlist.txt -m 5

the -w flag writes the output to a file so you can actually use it, and -m 5 sets a minimum word length so you're not cluttering the list with three-letter noise. use that file as a denylist input for your password policy tooling, most identity providers and self-hosted auth systems let you block specific strings or patterns at signup and reset.

crunch: when you know the pattern

crunch generates wordlists from a defined character set and length instead of scraping or reusing a leaked list. it's useful for testing "we require 8 characters, a number, and a symbol" style policies to see how weak that actually is in practice.

crunch 8 8 -t P@ssword%^ -o test_patterns.txt

this generates every combination matching that pattern at exactly 8 characters. if your policy allows something predictable like "capital letter, word, single digit," crunch can show you just how small that real keyspace is, way smaller than the policy makes it sound. that's the number you want to know before an attacker does.

the right list beats a bigger list

a huge generic wordlist is a blunt instrument. a small, targeted list built from your own branding, your own leaked breach data, and your own password policy quirks is what actually gets through. that's true whether you're the one testing or the one being tested, which is exactly why it matters for defense. run these tools against your own environment, feed the results into your denylist, and force multi-factor authentication so a cracked password isn't game over anyway.

the takeaway

attackers moved past rockyou years ago, and your defenses need to as well. pull seclists for structured, purpose-built wordlists, use cewl on your own site to see what your brand is leaking into potential passwords, and use crunch to stress test the actual keyspace your password policy allows. then take everything you find and turn it into a denylist, a stronger policy, and mfa everywhere it counts. the goal isn't a bigger wordlist, it's a smaller attack surface.