Guide
Building targeted password wordlists from a roster
A ten-million-line generic wordlist is the wrong tool for a password spray. It is slow, noisy, and mostly irrelevant to one organisation. When you already have a roster — a list of employees from OSINT, an org chart, a LinkedIn scrape you were authorised to collect — a short, targeted list built from that roster lands far more hits per attempt.
Generic dumps vs. targeted lists
rockyou.txt and its cousins are built from unrelated breaches. Against a corporate login they burn thousands of attempts on passwords no one at that company would pick. A targeted list is built from the target's own people and vocabulary, so a much smaller set of candidates covers the passwords humans there actually choose.
This matters most under lockout policies: when you get five attempts before an account locks, those five need to count. Quality of candidates beats quantity every time.
From a name to a credential candidate
People build passwords from a handful of predictable ingredients: their own name, the company name, the current season or year, and a symbol to satisfy the complexity rule. Firstname + season + year + ! covers a depressing share of real corporate passwords.
Mangling rules turn a roster into those candidates automatically — case variations, leetspeak substitutions, appended years and symbols, first-initial-plus-surname permutations. The art is generating enough variants to catch real passwords without exploding the list back into generic-dump territory.
Spray responsibly
Password spraying trips account lockouts and alerting if you are careless. Stay under the lockout threshold, spread attempts over time, and know the domain's lockout policy before you start. This is an activity for engagements you are authorised to run, against accounts in scope.
ApexDrift's Wordlist Builder takes a roster you already have — it never scrapes for you — and applies name-and-context mangling rules to produce a targeted candidate list. You supply the people; it produces the passwords worth trying first.