Common Uses:
Cracking passwords (e.g., with tools like Hydra or Hashcat).
Fuzzing web applications to find directories or files (e.g., using Gobuster or Dirbuster).
Testing login credentials for services.
Few Github repos to get wordlists, be aware that there are wordlists based on countries too :
GitHub - kkrypt0nn/wordlists: 📜 Yet another collection of wordlists
📜 Yet another collection of wordlists. Contribute to kkrypt0nn/wordlists development by creating an account on GitHub.
GitHub - gmelodie/awesome-wordlists: A curated list wordlists for bruteforcing and fuzzing
A curated list wordlists for bruteforcing and fuzzing - gmelodie/awesome-wordlists
If you don't find what you're looking for, or if you have some clues about how a password / username is composed, you can create your own wordlists with tools like :
Crunch : Generate a wordlist with passwords of 6 characters containing only lowercase letters:
Code
crunch 6 6 abcdefghijklmnopqrstuvwxyz -o wordlist.txt
Hashcat (maskprocessor) : Generate passwords of 8 characters with uppercase, lowercase, digits, and special symbols:
Code
mp64.bin ?u?l?l?l?d?d?s?s > wordlist.txt
You can add those wordlists in tools such as Hydra or xHydra for cracking, as shown below.
2. TOOLS FOR BRUTEFORCING / CRACKING
A. Hydra and xHydra
Hydra is a fast and flexible password-cracking tool included in Kali Linux. It is used to perform brute-force and dictionary attacks on various network protocols and services. xHydra is the same tool but with a GUI (Graphic User Interface).
Basic syntax :
Code
hydra [options] [target] [service]
Options :
USERNAME : can be signe (-l) or from a list (-L)
PASSWORD : can be single (-p) or from a list (-P)
TARGET : can be single or from a list (a .txt file with many IP addresses, public or private)
...