• Hashcat to combine lists of potential names and labels with specific mutation rules to create custom wordlists.
• To become more familiar with Hashcat and discover the full potential of this tool, we recommend the module Cracking Passwords with Hashcat.
• Hashcat uses a specific syntax for defining characters and words and how they can be modified.
• The complete list of this syntax can be found in the official documentation of Hashcat.

the ones listed below are enough for us to understand how Hashcat mutates words.

Each rule is written on a new line which determines how the word should be mutated. If we write the functions shown above into a file and consider the aspects mentioned, this file can then look like this:

custom.rule

cat custom.rule

Generating Rule-based Wordlist

hashcat --force password_list -r custom.rule --stdout | sort -u > mut_password.list
cat mut_password.list

Hashcat and John come with pre-built rule lists that we can use for our password generating and cracking purposes. One of the most used rules is best64.rule, which can often lead to good results.

Hashcat Existing Rules

ls /usr/share/hashcat/rules/

We can now use another tool called CeWL to scan potential words from the company's website and save them in a separate list. We can then combine this list with the desired rules and create a customized password list that has a higher probability of guessing a correct password. We specify some parameters, like the depth to spider (-d), the minimum length of the word (-m), the storage of the found words in lowercase (--lowercase), as well as the file where we want to store the results (-w).

Generating Wordlists Using CeWL

cewl <https://www.inlanefreight.com> -d 4 -m 6 --lowercase -w inlane.wordlist
wc -l inlane.wordlist