Introduction to Wordlists

This room will guide you through the fundamentals of using, building, and refining wordlists for ethical hacking and penetration testing. Wordlists are powerful text files containing potential usernames, passwords, and directory names, and are essential tools for password cracking, directory enumeration, and other automated testing tasks.

Learning Objectives

• Learn what wordlists are and where they're used in offensive security.
• Discover how to gather company-specific terms and usernames using open-source intelligence (OSINT) techniques.
• Create, clean, and deduplicate custom wordlists.
• Use your refined lists with tools like ffuf to uncover hidden web directories and Hydra to brute-force login pages.

Prerequisites

Before starting this room, you should be comfortable with:

• Basic Linux command-line navigation (ls, cat, grep, sort)
• Making HTTP requests from the terminal (curl, wget)
• Basic web concepts: HTTP status codes and how login forms work

Follow each task in order and read the explanations carefully. By the end of this room, you'll have a solid foundation for building targeted wordlists and using them effectively during engagements.