Ethical Hacking: Creating Wordlists

Understanding the Fundamentals

In previous discussions about WPA and WPA2 security, we established that handshake packets contain crucial information for password verification. However, these packets don't provide enough data to directly recover or recalculate the original key.

This limitation leads us to a methodology called wordlist attack, which involves:

1. Creating or obtaining a comprehensive list of potential passwords
2. Using the captured handshake to verify each password
3. Continuing this process until a valid password is found

Creating Custom Wordlists with Crunch

While pre-made wordlists are available online, creating custom wordlists tailored to specific scenarios can significantly improve success rates. Crunch is a powerful tool that generates custom wordlists based on specified parameters.

Basic Crunch Syntax

The basic parameters include:

• min-length: Minimum password length to generate
• max-length: Maximum password length to generate
• character-set: Characters to use in password generation
• options: Additional specifications (pattern, output file, etc.)

Example 1: Basic Wordlist Generation

Generate passwords between 6-8 characters using only lowercase a, b, c and numbers 1, 2:

Example 2: Pattern-Based Generation

Generate 6-character passwords that start with 'A' and end with 'B':

In the pattern:

• A and B are fixed characters
• Each @ will be replaced with characters from the specified character set

Advanced Crunch Options

Option	Description	Example
-t [pattern]	Define a pattern for generated passwords	-t P@ssw@@d
-o [filename]	Output to a file instead of stdout	-o my_wordlist.txt
-p [charset]	Generate passwords without repeating characters	-p abcd1234
-s [startstring]	Start at a specific string	-s abc123
-b [size]	Specify output file size (KB, MB, GB)	-b 10MB

Practical Tips for Effective Wordlist Creation

1. Narrow Down the Scope

If you have any information about the target password, use it to reduce the search space:

• Known length range (most passwords are 8-12 characters)
• Known patterns (many corporate passwords follow similar formats)
• Special requirements (uppercase, lowercase, numbers, etc.)

2. Target-Specific Wordlists

Consider creating wordlists based on:

• Company name variations
• Industry-specific terminology
• Location-specific information
• Relevant dates (founding year, significant milestones)

3. Optimize for Space and Performance

Be mindful of wordlist size:

This command would generate 208,827,064,576 passwords (nearly 2TB of data)!

Instead, use more targeted approaches:

This generates only 10,000 passwords that all start with "P@ss".