Password Attacks
Wordlists
Every attack on this page is only as good as the guesses you feed it, so Oniomarchy installs the standard wordlists up front and puts them where the tools expect to find them. These aren’t programs — the menu entries open the wordlist directories in your file manager so you can see what’s there.
What’s installed
| Package | Lives at | What it is |
|---|---|---|
| rockyou | /usr/share/dict |
The famous ~14 million real passwords from the RockYou breach — the default first pass for almost any crack. |
| seclists | /usr/share/doc/seclists |
Daniel Miessler’s SecLists: the big curated collection — passwords, usernames, web-content and DNS discovery lists, fuzzing payloads, and more. |
| wordlists | /usr/share/wordlists |
Arch’s packaged wordlists collection, a convenient central directory. |
All three appear under Security → Password Attacks, and each opens its folder directly.
Using them
Point any cracker or fuzzer at these paths:
# The classic first attempt
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt
# SecLists has purpose-built lists for each job
gobuster dir -u http://10.0.0.5 \
-w /usr/share/seclists/Discovery/Web-Content/common.txt
hydra -l admin \
-P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt \
ssh://10.0.0.5SecLists is the one to get familiar with — it’s organized by task
(Discovery/, Fuzzing/, Passwords/, Usernames/), so there’s usually a
list already shaped for exactly what you’re doing.