Tools

Generates subdomain permutations and alterations from a wordlist of common patterns (dev, staging, api-v2) and resolves the results.

altdns -i subdomains.txt -o data_output -w words.txt -r -s results.txt

Interactive wordlist generator that builds candidate passwords from personal-info keywords plus configurable leet/case/special-character mutations, similar in spirit to CUPP with more mangling options.

bopscrk -w words.txt

Spiders a website and builds a custom wordlist from the words it finds — useful for generating a target-specific password/username dictionary rather than relying on rockyou alone.

cewl https://target.tld -d 2 -m 5 -w wordlist.txt

Queries Have I Been Pwned's Pwned Passwords range API with only a 5-character SHA-1 prefix, so the full password/hash never leaves your machine, and greps the response for the suffix.

hash=$(printf %s 'password123' | sha1sum | tr 'a-z' 'A-Z' | cut -c1-40)
curl -s "https://api.pwnedpasswords.com/range/${hash:0:5}" | grep -i "${hash:5}"

Free online lookup of a hash against a precomputed table of billions of cracked passwords — worth trying before spinning up hashcat for an unsalted common hash.

Common User Passwords Profiler — interviews you about a target's personal details (name, pet, birthdate) and generates a targeted candidate password list from the answers.

cupp -i

Dictionaries of attack payloads and predictable filenames/paths for discovery and fuzzing (injection strings, common backup/config filenames, error-message patterns), maintained separately from SecLists.

Subdomain-permutation generator similar in purpose to altdns, with adjustable permutation depth and its own wordlist format.

gotator -sub subdomains.txt -perm permutations.txt -depth 1 -numbers 3

GUI wordlist generator that lets you build mangling rule chains (leetspeak, appended years, case toggling) visually and export them for Hashcat/John.

Analyses a leaked or cracked password list and reports the most common base words, lengths and patterns — used to tune a follow-up wordlist or mangling rules against the same target.

ruby pipal.rb cracked.txt

Password lists sorted by real-world frequency (most-likely-first) rather than alphabetically, so a time-boxed cracking run tries the probable candidates before the unlikely ones.

The most famous password wordlist in the field — 14 million real passwords leaked from the 2009 RockYou breach, still the default dictionary for a first hashcat/John pass.

Word-mangling tool (leetspeak substitutions, case flips, appended years/symbols) that expands a small seed wordlist into a much larger set of realistic password variants.

rsmangler --file words.txt > mangled.txt

The single most-used wordlist collection in the field — usernames, passwords, URLs, fuzzing payloads and more, curated and maintained, and bundled by default in Kali.

Site hosting large curated password wordlists (compiled from breaches and generated sets) plus a hash-lookup search, aimed squarely at cracking rather than fuzzing.