Password Mutation & Custom Wordlists

Password mutation means building a wordlist tailored to the target instead of blindly reaching for rockyou.txt. You start from words specific to the organisation and apply the same transformations people use when they "complicate" their password, so that cracking or spraying hits much sooner.

Why it works. Password policies push people toward predictable patterns: they take a meaningful word (the company name, the product, the season) and add an initial capital, a number and a symbol (Inlanefreight2024!). A generic wordlist rarely carries those combinations, but a wordlist based on the target's vocabulary and mutated with rules does generate them.

The abuse. You harvest words from the website with CeWL, generate plausible usernames with username-anarchy, and expand each word with hashcat rules (capitalisation, leet, suffixes).

# build a wordlist from keywords on the target's website
cewl https://<domain> -d 4 -m 6 --lowercase -w wordlist.txt

# expand the wordlist by applying rules (leet, suffixes, capitalisation)
hashcat --force wordlist.txt -r /usr/share/hashcat/rules/best64.rule --stdout > mutado.txt

# generate likely usernames from first and last names
./username-anarchy -i names.txt

# CUPP: tailored profile (name, dates, pet...)
cupp -i
# combine several rules and add years by hand
hashcat wordlist.txt -r /usr/share/hashcat/rules/best64.rule -r /usr/share/hashcat/rules/toggles1.rule --stdout > mutated.txt
for y in 2023 2024 2025; do sed "s/\$/$y!/" wordlist.txt; done >> mutated.txt

Requirements. No special access is needed: only public information about the target (its website, its employees) and the generation tools. Effectiveness rises the better you know the password policy and the organisation's jargon.

How to detect it. Generating the wordlist is offline and leaves no trace on the target; what gets detected is its use: a burst of authentication attempts (spray or brute force) with very "in-house" passwords. The signal is the same as spraying: many users tried with few passwords, or a spike of logon failures with patterns like Company2024!.

Defence. Long, random passwords (a password manager), banned-password lists that include the company name and its leet variants, MFA so that a guessed password is not enough, and account lockout to slow brute force. It is the step before hash cracking and password spraying, and it complements credential hunting.