Password Cracking - Custom Wordlist Attack

What is a custom wordlist attack?

Custom wordlist password cracking means building your own dictionary for one specific target instead of reaching for a generic leak dump. A shared list like rockyou.txt only contains passwords that have already been exposed somewhere else. It is excellent at catching lazy reuse and useless against someone who invented a password from their own life: a pet, a band, the name of the thing they built.

Real assessors close that gap by harvesting the target first. Staff pages, conference bios, changelogs and social posts hand over the raw material, and a few hundred words taken straight off the target's own site beat fourteen million generic ones every time.

How this lab works

You get the website of a small game studio. The team page and the devlog are written the way real small companies write them, full of pets, hobbies, in-jokes and project names. None of it is a password. All of it is the ingredients.

You will not write that list by hand, and you will not have to decide which words look promising. The work is mechanical, and the tools you need are already on the box.

You will find an old database export the studio forgot to remove, identify the unsalted MD5 hashes inside it, and crack them with the list you generated, john mangling rules and a second pass over the joined pairs. That gets you into the internal portal. Inside is a password-protected archive, and the same list gets you through that too, this time using zip2john to turn the archive into something John can attack.

Why practice password cracking in a lab?

Hash cracking looks like a tooling problem and is really a research problem. Anyone can point john at rockyou.txt. Knowing what to feed it is what separates a failed audit from a successful one, and it is the part that no tool does for you. This hands-on HackerDNA lab gives you a target whose answer is sitting in plain sight on a public page, and shows you how to hand John every word of that page instead of trusting your instinct about which one matters.

You will also meet a genuinely common finding along the way: a password reused between a retired system and a live one. It is one of the most reliable ways into a small organisation, and it costs nothing to test.