Package: wordz
wordzWordlists builderIntroductionThis tool evolved from the helper scripts used for thebrutasproject. It is used for generating and managing wordlists for password cracking, content discovery, fuzzing etc.RequirementsGNU/Linux, macOShashcathashcat-utilsGNU tools:cat,awk,comm,sort,uniqRecommendedIflzopis detected it will be used bysortto compress temporary file, especially useful with large datasets.UsageSourcesLet's say you have sometests/data/keywords.txtlike the following:acapulco
cervejaAlso, you know of a few common suffixes (tests/data/bits.txt) used in this particular case, namely:!
123We would use a modest set of Hashcat rules (tests/data/hashcat.rule): one that simply passes a keyword, and the other one that makes it upper case. Like these::
uClassesNow it's time to design a class that will build the wordlist for us according to some requirements, e.g.:bits after each keywordbits before each keywordand on both sides of a keywordfrom wordz import Combinator


class Passwords(Combinator):

    wordlists = (
        'data/keywords.txt',
    )
    rules = (
        'data/hashcat.rule',
    )

    def process(self):

        self.merge(
            self.output('passwords.txt'),
            (
                self.right(self.temp('hashcat-data-keywords.txt'), self.base('data/bits.txt')),
                self.left(self.temp('hashcat-data-keywords.txt'), self.base('data/bits.txt')),
                self.both(self.temp('hashcat-data-keywords.txt'), self.base('data/bits.txt')),
            )
        )What happens in the background is thatwordztakes allwordlistsdefined on the class level and parses them usingrules. It is done with thesetupmethod which is launched beforeprocess, and which you can override with your own logic (however, you will probably want to keepself.wordlists_process()in there).This is how we know the name of the file in the temporary directory: it is composed of the name of the rule (hashcat), the name of the parent directory (data) and name of the keywords file without extension (keywords).There are three "shortcuts" for directories available in eachCombinatorinstance:base(),temp()andoutput().BuildingNow it's time to build our lists:$ mkdir tmp
$ wordz -p data/classes.py::PasswordsThe result should now be inpasswords.txt.Advanced usageIf you want to see how it is used in more advanced cases, have a look intotestsor thebrutasproject.Command lineOnce installed, you can callwordzfrom the command line. Here are the arguments you can use:usage: wordz [-h] -p PATH [-b BASE_DIR] [-t TEMP_DIR] [-o OUTPUT_DIR] [-v] [--min-length MIN_LENGTH] [--cores CORES] [--memory MEMORY] [--bin-hashcat BIN_HASHCAT] [--bin-combinator BIN_COMBINATOR] [--bin-rli2 BIN_RLI2] [-d | -q]

options:
  -h, --help            show this help message and exit
  -p PATH, --path PATH  Class path (e.g. classes/passwords.py::ExtraPasswords)
  -b BASE_DIR, --base-dir BASE_DIR
                        Base directory path (default: .)
  -t TEMP_DIR, --temp-dir TEMP_DIR
                        Temporary directory path (default: tmp)
  -o OUTPUT_DIR, --output-dir OUTPUT_DIR
                        Output directory path (default: .)
  -v, --version         Print version
  --min-length MIN_LENGTH
                        Minimal length for a password when merging lists (default: 4)
  --cores CORES         Number of cores to be used for sorting (default: CPUs-based)
  --memory MEMORY       Percentage of memory to be used for sorting (default: 80%)
  --bin-hashcat BIN_HASHCAT
                        Hashcat binary (default: hashcat)
  --bin-combinator BIN_COMBINATOR
                        Hashcat utils `combinator` binary (default: combinator.bin)
  --bin-rli2 BIN_RLI2   Hashcat utils `rli2` binary (default: rli2.bin)
  -d, --debug           Debug mode
  -q, --quiet           Quiet mode