1. Merge with existing wordlists
# Combine CUPPX output with rockyou + seclists
cat target_wordlist.txt /usr/share/wordlists/rockyou.txt > combined.txt
sort -u combined.txt -o combined.txt
# Or use multiple wordlists
cat target_wordlist.txt rockyou.txt seclists/*.txt | sort -u > mega.txt
# Merge + dedup (fast, preserves order)
awk '!seen[$0]++' target_wordlist.txt rockyou.txt > merged.txt
2. Apply rules for massive expansion
Rules mutate each word (add digits, leet speak, capitalize, reverse...). A 2K wordlist + best64 = 130K candidates. With OneRuleToRuleThemAll = 100M+.
# Hashcat with rules (GPU)
hashcat -m 1000 hashes.txt target_wordlist.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 1000 hashes.txt target_wordlist.txt -r /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule
# John with rules (CPU)
john --wordlist=target_wordlist.txt --rules=Best64 --format=NT hashes.txt
john --wordlist=target_wordlist.txt --rules=KoreLogic --format=NT hashes.txt
3. Recommended attack order
- CUPPX wordlist alone - fast, catches obvious passwords
- CUPPX + best64 rules - x65 expansion, catches mutations
- rockyou.txt - 14M common passwords
- rockyou + best64 - 930M candidates
- Merged (CUPPX + rockyou) + OneRuleToRuleThemAll - billions, thorough
- Mask attack - if you know the pattern (e.g., Company2024!)
4. Popular rule files
| Rule |
Mutations |
Best for |
| best64.rule | 65 | Fast first pass, high ROI |
| d3ad0ne.rule | 34,101 | Community rules, good coverage |
| dive.rule | 99,090 | Deep mutations |
| OneRuleToRuleThemAll | 52,000 | Best single rule file, thorough |
| KoreLogic | varies | Corporate passwords (Company2024!) |