How to Create a Powerful Wordlist Using John the Ripper
Password attacks are a core part of penetration testing, red teaming, and CTF challenges. While most people rely on existing wordlists like RockYou, a custom wordlist often gives significantly better results, especially when you understand the target environment.
John the Ripper (JtR) is not only a password-cracking tool; it is also an extremely powerful wordlist generator. With the right configuration and rules, you can create tailored password lists based on real-world patterns.
Why Create a Custom Wordlist
A generic wordlist works for broad attacks, but real targets often use predictable patterns such as:
· names and variations
· months and years
· combinations with numbers
· special character suffixes
· mixed-case versions
· leetspeak substitutions
John the Ripper can automate all of this through its rule engine.
1. Preparing a Base Wordlist
The first step is to prepare a small input file that contains meaningful keywords about the target. This might include:
· names (usernames, company name, place)
· predictable terms (password, admin, welcome)
· patterns (city, phone numbers, pet names)
Example base file:
Save it as base.txt. This small list will be used by John to generate thousands of mutated variants.
2. Simple Wordlist Generation Using Default Rules
John has built-in rules that automatically perform common password mutations.
Command:
john — wordlist=base.txt — rules — stdout > wordlist.txt
This generates variations such as uppercase, lowercase, capitalized, numbers appended, symbols appended, and reversed forms.
3. Advanced Wordlist Generation Using Specific Rule Sets
John includes multiple rule sets, such as Single, Wordlist, All, and KoreLogic.
Using the full rule set:
Get Pentestermadhu’s stories in your inbox
Join Medium for free to get updates from this writer.
john — wordlist=base.txt — rules=All — stdout > advanced_list.txt
4. Using the KoreLogic ruleset:
john — wordlist=base.txt — rules=KoreLogic — stdout > korelogic_list.txt
5. Creating Your Own Custom Rules
You can create a fully customized rule set when you want complete control. Rules are written inside John’s configuration file.
Example custom rule:
Open the configuration file and navigate to or create a [List.Rules] section. For example:
[List.Rules:MyCustomRules]
cAz”[0–9]”
cAz”[0–9][0–9]”
cAz”[!@#$%]”
The format for a rule set header is: [List.Rules:RuleSetName]
Generate the custom list:
john — wordlist=base.txt — stdout — rules= MyCustomRulesForTesting > My_Wordlists
6. Using John as a Pure Word Generator (Incremental Mode)
Generate all 3-digit numeric combinations:
john — incremental=Digits — min-length=3 — max-length=3 — stdout > digits3.txt
Generate lowercase words of length 5:
john — incremental=Lower — min-length=5 — max-length=5 — stdout > lower5.txt
Best Practices
· Start with a meaningful base wordlist.
· Use rule-based generation for targeted, realistic mutations.
· Avoid generating extremely large files unless necessary.
· For WiFi and web logins, include years and simple patterns in the base list.
· For OSCP or real pentests, KoreLogic or custom rules produce the best results.
Conclusion
John the Ripper is far more than a password cracker. Its rule engine and incremental modes make it a powerful wordlist generator capable of producing highly targeted and efficient password lists.
By combining base keywords, rule sets, and custom configurations, you can build wordlists specifically suited for WiFi attacks, corporate pentests, or CTF challenges.
