I recently put together a script that might be useful for those working on password list generation.
The idea behind it is simple: many businesses include words in their websites (like parts of phone numbers, addresses, or other common terms associated with the business) that can be used to build a targeted password cracking list.
What the Script Does:
Crawls a Website: Starts at a given URL and recursively crawls internal pages, up to a user-specified depth.
Extracts Text: Extracts all words from the site, with special handling for phone numbers. It breaks down phone numbers into components (area code, prefix, line number) since these fragments are often used in passwords.
Filters Stop Words (Optional): Removes common stop words (or custom ones you provide) to focus on more relevant data.
Generates a Ready-to-Use Wordlist: Sorts the words by frequency and lets you choose how many of the top words to include (or include all). The final wordlist is saved as "wordlist.txt", ready for use with tools like Hashcat.
For example:
A coffee shop's WiFi password might be "Coffee2025" (using "coffee", a commonly used word on their site, and the current year), or "123MainStreet" (their address), or even "515-222-1234" (their phone number). Including words relevant to the company in your list increases the likelihood of matching actual passwords.
I built this script because I noticed that many businesses use industry specific words and/or location specific (phone, address) in their password choices. If you're interested in using or tweaking the script, feel free to ask questions or share your thoughts.
Ethical Use:
This script is intended for ethical security testing and research. Use it only on websites where you have permission to test or as part of an authorized security audit. Its purpose is to help identify weak password choices and improve security—not for illegal access.