---

Platform Note: This framework is designed and tested primarily on Linux (Debian/Ubuntu/Kali). Most hardware-dependent modules (wireless adapters, USB devices, raw socket access, firmware tools) require Linux. Running on Windows or macOS may cause errors or limited functionality in many modules. Linux is strongly recommended for maximum compatibility.

---

WordlistXPL-Forge

Unified wordlist generation toolkit for pentest and red team operations: 70+ subcommands in a single CLI (v2.0). Official member of the XPL-Forge suite. Charset/mask generation, personal and corporate target profiling, web scraping (JS/CSS/PDF extraction), OCR, document parsing (PDF/XLSX/DOCX), leet speak permutations, XOR crypto, DNS/subdomain fuzzing, phone number generation, corporate user enumeration, retail/pharmacy credential patterns, default credential databases (IoT/ICS/SCADA/PLC/HMI), ISP WiFi keyspace generation, password-DNA behavioral analysis, keyword combiner, word mangling, merge and sanitize, ML-based ranking with SecLists corpus training, statistical analysis, PCFG probabilistic grammar generation, OMEN-style Markov chain generation, keyboard walk generation, automatic hashcat rule generation, PRINCE combinatorial chaining, wordlist quality benchmarking, phrase-initials acrostic generation, existing-password mutation engine, digit-to-text variants (EN/PT/BR/ES), OSINT permutation, CUPP-style profiling, MAYA ranking, anomaly scoring, global length filters, and disk-space safety checks. It also runs and converts hashcat/John rules, performs high-performance list operations (dedup, subtract, split, keyspace), optional neural generation (FLA/PassGPT style), zxcvbn-style strength scoring with HIBP, hash identification and generation, hcmask export, advanced OSINT (Wayback/GitHub org), diceware passphrases, MAYA-style engine evaluation and curation, plus Aurora v2 multi-engine pipeline / session / br-deep / serve / evolutionary engines.

CLI: wlf / python wlf.py.

Author: André Henrique (mrhenrike) | União Geek | https://uniaogeek.com.br/

Full documentation: docs/COMMAND-COVERAGE.md · docs/CLI-REFERENCE.md · docs/MODELS.md · CHANGELOG.md · Wiki

---

DISCLAIMER: This tool is intended exclusively for authorized security testing, penetration testing, lab work, and education. Unauthorized use against systems you do not own or have explicit written permission to test is illegal and unethical. The author assumes no liability for misuse of the code or of any function in this toolkit.

The generator emits many password and username patterns (names, dates, brands, leet, years, keyboard walks, grammar models, and similar). If you, your company, or a user build secrets from public information, predictable patterns, or personal data (name, team, pet, date, brand, domain), the chance that this tool emits a wordlist containing a real password or username is extremely high, almost certain.

That is not a leak and does not prove a prior breach. It is weak or predictable secret choice. Use a password manager and MFA.

This public tree ships the same generator. It does not distribute a Brazilian password corpus (wlist_brasil) and it does not ship operator-supplied corporate OSINT wordlists. It does ship vendor factory default credentials, username samples, lab lists, and discovery paths. Pass --vars, --domain, --brand, --name (and similar flags) with your authorized-engagement data.

---

Quick Start

Install via pip

pip install wordlistxpl-forge              # core
pip install wordlistxpl-forge[full]        # all extras (OCR, docs, scrape, gpu, api)
pip install wordlistxpl-forge[ocr]         # OCR only (needs extra system libs)
pip install wordlistxpl-forge[docs]        # PDF/XLSX/DOCX extract
pip install wordlistxpl-forge[scrape]      # extra scrape parsers
pip install wordlistxpl-forge[gpu]         # torch / transformers (neural / GAN / VAE)
pip install wordlistxpl-forge[api]         # FastAPI serve mode

wlf --help                 # 70+ subcommands (v2.0)
pip show wordlistxpl-forge

Clone from source

git clone https://github.com/mrhenrike/WordlistXPL-Forge.git
cd WordlistXPL-Forge

python3 -m venv .venv
source .venv/bin/activate   # Windows: .\.venv\Scripts\Activate.ps1
pip install -r requirements.txt pyyaml

Run

python wlf.py              # interactive menu
python wlf.py --help       # full CLI help (v2.0 Aurora commands included)
wlf --help                 # after pip install

# v2 quick examples (authorized testing only)
python wlf.py --limit 2000 br-deep --sector finance -o /tmp/br.lst
python wlf.py pbmp --n-engines 5
python wlf.py score 'Admin2024!'
python wlf.py session list
# python wlf.py serve --port 8771   # needs: pip install wordlistxpl-forge[api]

Prefer pip install wordlistxpl-forge or run python wlf.py from this tree.

Per-command pages: docs/commands/ (en-US) and docs/pt-BR/commands/.

---

Subcommands

Nested modes (also documented): pcfg train, pcfg generate, markov train, markov generate, neural train, neural generate.

Detailed syntax and examples for each subcommand: docs/COMMAND-COVERAGE.md · Wiki

Global Flags

Global flags go before the subcommand.

python wlf.py --threads 20 --compute cuda --no-ml --min-len 8 --max-len 20 --limit 100000 charset 8 12

--limit is global. Example: wlf --limit 5 charset 3 3 ab.

---

Common Usage Examples

Examples use placeholders (acme, xpto, brandx, corpx, pessoax, personay, robotx). Replace them with data from your authorized engagement.

Corporate pentest: generate users + passwords

python wlf.py corp-users --domain acme.example --file employees.txt --passwords --combo -o acme_combo.lst

Personal target profiling

python wlf.py profile --name "PessoaX" --nick robotx --birth 15/03/1990 --leet aggressive -o target.lst
python wlf.py cupp --first-name PessoaX --last-name PersonY --company BrandX -o cupp.lst
python wlf.py osint-perm --first-name PessoaX --last-name PersonY --nick robotx --birth 01/1990 --complexity 2 -o osint.lst

Charset with hashcat mask

python wlf.py charset 8 8 --mask "?u?l?l?l?d?d?d?s" -o passwords.lst

Template-based patterns

python wlf.py pattern -t "{company}{year}!" --vars company=acme,xpto,brandx year=2020-2026 -o patterns.lst

DNS subdomain fuzzing

python wlf.py dns -d acme.example --words dev staging api admin portal -o subdomains.lst

Analyze an existing wordlist

python wlf.py analyze passwords.lst --top 30 --masks --format json -o analysis.json

Default credentials lookup

python wlf.py default-creds --list-vendors
python wlf.py default-creds --vendor mikrotik --format combo -o mikrotik_creds.lst
python wlf.py default-creds --protocol snmp --format user -o snmp_users.lst

ISP WiFi keyspace generation

python wlf.py isp-keygen --list
python wlf.py isp-keygen --isp xfinity_comcast --estimate
python wlf.py isp-keygen --isp xfinity_comcast --limit 100000 -o xfinity.lst

Web scraping with JS/CSS/PDF

python wlf.py scrape https://acme.example --include-js --include-css --include-pdf --lowercase -o words.lst
python wlf.py scrape https://acme.example --emails --output-emails emails.txt --output-urls urls.txt
python wlf.py scrape-target --url https://acme.example --depth 2 --max-pages 20 -o crawl.lst

Merge, sanitize, improve

python wlf.py merge list1.lst list2.lst --min-len 6 --sort -o merged.lst
python wlf.py sanitize merged.lst --inplace
python wlf.py improve merged.lst --leet aggressive --year-start 2020 --year-end 2027 -o improved.lst
python wlf.py leet-perm words.lst --max-per-word 256 -o leet_words.lst

Keyword permutation

python wlf.py combiner --keywords admin,router,brandx -o combo.lst
python wlf.py iwlgen --keywords admin,router,2026 --connectors @. --leet -o iwl.lst

Targeted cracking workflow (combiner + affix + rules)

Chain per-component CamelCase and linguistic connectors (combiner) with composite date/special affixes (affix), then let hashcat apply the affix rule set on the GPU so the large expansion never has to be written to disk:

python wlf.py combiner alpha bravo charlie --titlecase --link-lang pt --assume-yes \
    --connectors 'EMPTY,_,.,na,no,da' -o bases.lst
python wlf.py affix bases.lst --dates '0724,1988' --specials '!,@,#' --emit-ruleset affix.rule
hashcat -a 0 -m 1000 hashes.txt bases.lst -r affix.rule

Coverage matrix and per-flag pages: docs/COMMAND-COVERAGE.md

---

Password DNA

Analyze password patterns and generate behavioral variants. The password-dna subcommand extracts structural "DNA" from known passwords (uppercase, lowercase, digit, symbol positions) and produces new candidates that follow the same behavioral patterns.

python wlf.py password-dna --input known_passwords.lst --depth 2 -o dna_variants.lst
python wlf.py password-dna --seed "BrandX2024!" --depth 3 --leet -o seed_variants.lst
python wlf.py password-dna --input known_passwords.lst --analyze-only --format json -o dna_report.json

---

PCFG Grammar Engine

Train a Probabilistic Context-Free Grammar from a password corpus and generate candidates in probability order (most likely first). Based on Weir et al. (IEEE S&P 2009).

python wlf.py pcfg train --wordlist rockyou.txt
python wlf.py pcfg generate -o candidates.lst --limit 1000000
python wlf.py pcfg generate --top-structures 50 --top-terminals 100 --min-len 8

Markov Chain Generator

OMEN-style positional Markov chain generator. Learns per-position character transitions and generates in ascending cost order (most probable first).

python wlf.py markov train --wordlist leaked.txt --order 3
python wlf.py markov generate --min-len 6 --max-len 12 --max-cost 30 --limit 500000

Keyboard Walk Generator

Generate passwords based on physical keyboard adjacency walks. Supports QWERTY, AZERTY, QWERTZ, Dvorak, and numpad layouts.

python wlf.py kwalk --min-len 4 --max-len 10 -o walks.lst
python wlf.py kwalk --layout qwerty,numpad --no-shift --max-changes 2
python wlf.py kwalk --list-layouts

Hashcat Rule Auto-Generation

Analyze real passwords and automatically generate hashcat-compatible .rule files by reverse-engineering transformation patterns.

python wlf.py rulegen --wordlist leaked.txt -o rules.rule --top-rules 200
python wlf.py rulegen --wordlist passwords.lst --dictionary english.txt -o optimized.rule

PRINCE Attack Mode

PRINCE (PRobability INfinite Chained Elements) generates passwords by combining multiple words from a wordlist. Discovers multi-word passwords like correcthorsebatterystaple.

python wlf.py prince --wordlist top1000.txt --min-elem 2 --max-elem 4 -o prince.lst
python wlf.py prince --wordlist words.txt --separator "-" --case-permute --min-len 8

Wordlist Quality Benchmark

Measure the effectiveness of a generated wordlist against a reference set. Reports hit rate, efficiency, diversity, coverage by length/charset, and estimated crack times.

python wlf.py benchmark --wordlist generated.lst --reference rockyou_sample.txt
python wlf.py benchmark --wordlist output.lst --reference test_set.txt --json report.json
python wlf.py maya-rank generated.lst --top 1000 -o ranked.lst
python wlf.py anomaly-score wordlist.lst --top 50
python wlf.py pattern-rank passwords.lst --layout qwerty

---

Rule Engine

Run hashcat and John the Ripper rules against a wordlist (the equivalent of hashcat --stdout -r), convert between the two dialects, and optimize rule files.

python wlf.py rules apply --wordlist base.txt --rules best64.rule -o out.lst
python wlf.py rules apply --wordlist base.txt --rule "c $1;so0;u" --dedupe
python wlf.py rules convert --rules hc.rule --to john -o jtr.rule
python wlf.py rules optimize --rules messy.rule -o clean.rule

High-Performance List Operations

Streaming utilities for very large lists: order-preserving deduplication (optional Bloom filter), set subtraction, splitting, and keyspace estimation.

python wlf.py dedup huge.txt --bloom --capacity 50000000 -o unique.txt
python wlf.py subtract candidates.txt --remove cracked.txt -o todo.txt
python wlf.py split big.txt --lines 1000000 -o part
python wlf.py split words.txt --by-length -o bylen
python wlf.py keyspace --mask "?u?l?l?l?d?d?d?d" --pps 5e9

Neural Generation (optional [neural] extra)

Character-level neural generation in the FLA and PassGPT tradition. Requires pip install wordlistxpl-forge[neural] (torch, plus transformers for PassGPT adapters). The core keeps working with pcfg and markov without this extra.

python wlf.py neural train --wordlist rockyou.txt --epochs 5
python wlf.py --limit 100000 neural generate --temperature 0.9 -o out.lst
python wlf.py --limit 5000 neural generate --prefix admin --mask "?u?l?l?l?d?d"
python wlf.py --limit 100000 neural generate --adapt cracked.txt   # Dynamic Password Guessing
python wlf.py --limit 5000 neural generate --adapter passgpt --model javirandor/passgpt-10characters

Password Strength and Entropy

zxcvbn-style scoring with pattern detection (dictionary, l33t, sequences, repeats, keyboard, dates), entropy, crack time per scenario and per hash, and optional HIBP check via k-anonymity.

python wlf.py strength "Summer2024!"
python wlf.py strength "P@ssw0rd" --hibp
python wlf.py strength --wordlist candidates.txt -o scored.tsv

Hashing and Cracking Interop

Identify hashes, generate digests for test corpora, and export hashcat masks.

python wlf.py hash-id 5f4dcc3b5aa765d61d8327deb882cf99
python wlf.py hash-gen --wordlist pw.txt --algo ntlm --format hash:plain -o ntlm.txt
python wlf.py hash-gen --wordlist pw.txt --algo bcrypt --format plain:hash
python wlf.py hcmask --wordlist leaked.txt --top 50 -o masks.hcmask

Advanced OSINT and Passphrases

Build contextual wordlists from passive OSINT (Wayback Machine, GitHub organizations) with lightweight NER and optional LLM enrichment, and generate diceware passphrases with a secure random source.

python wlf.py osint --wayback example.com --github-org acme --enrich -o rich.lst
python wlf.py osint --github-org acme --lowercase -o org.lst
python wlf.py passphrase --words 5 --separator . --capitalize --number
python wlf.py passphrase --wordlist eff_large_wordlist.txt --words 6 --symbol

Engine Evaluation and Curation

Compare engines by guess-number and coverage against a test split (MAYA-style), and rank candidate lists by crack rate to merge the best (weakpass-style).

python wlf.py evaluate --candidates pcfg.lst markov.lst --labels pcfg,markov --reference test.txt
python wlf.py curate --candidates a.txt b.txt c.txt --reference test.txt --top-k 2 -o best.txt

See the full competitive analysis and feature parity in docs/COMPETITIVE-ANALYSIS.md.

---

Default Credentials Database

Query the built-in database of 1,506 factory-default credentials covering 88 vendors (plus SNMP communities): routers, switches, printers, IP cameras, ICS/SCADA (PLCs, HMIs, RTUs), IoT gateways, and more.

python wlf.py default-creds --list-vendors
python wlf.py default-creds --vendor siemens --format combo -o siemens_creds.lst
python wlf.py default-creds --protocol modbus --format user -o modbus_users.lst
python wlf.py default-creds --category ics --format combo -o ics_defaults.lst
python wlf.py default-creds --export-all --format json -o all_defaults.json

---

Phrase, mutate, retail patterns, digit-to-text

Phrase-initials

python wlf.py phrase "my secret corporate phrase" -o phrase.lst
python wlf.py phrase "my secret corporate phrase" --prefixes _,__ --suffixes @0x90,#0x90 -o phrase.lst

Existing password mutation

python wlf.py mutate "Summer2024" -o mutated.lst
python wlf.py mutate "password123" --leet-mode aggressive --min-len 10 --max-len 25 -o mutated.lst

Retail / pharmacy chain patterns

--brand and --ids come from your engagement. Examples below are placeholders.

python wlf.py pharma --brand BrandX --ids 1200-1210 -o pharma.lst
python wlf.py pharma --brand CorpX --abbrevs CX,COR --cnpj 00000000000000 --mode passwords
python wlf.py pharma --brand BrandX --ids 1000-2000 --domains acme.example --mode usernames

Digit-to-text

Converts numbers (up to 12 digits) into text with case/leet/separator variants. Supports EN, PT, BR (feminine forms), and ES.

python wlf.py num2text --number 123
python wlf.py num2text --number 12 --lang br
python wlf.py num2text --number 123 --lang es
python wlf.py num2text --range 0-9999 --lang en -o number_words.lst
python wlf.py num2text --range 2000-2030 --lang pt -o years_pt.lst

Global length filters

python wlf.py --min-len 8 --max-len 20 charset 8 12 -o filtered.lst
python wlf.py --min-len 10 mutate "admin" -o long_variants.lst

---

What this tree ships

Not in this tree (local only under generated/, gitignored): users.lst and passwords.lst for local work. Discovery/creds/WAF/ISP banks live in sibling EmbedXPL-Forge resources. The CLI generates pattern families from the flags you pass; it does not ship credential dumps.

br-names can load an optional local BRWordList directory if you provide --brwordlist-path. That corpus is not bundled here.

---

Is a password in these lists?

This repository does not ship large password corpora. Check your local generated/ output or any list you generated:

# Your generated / local corpus
grep -qxF 'YourPassword' generated/passwords.lst && echo "FOUND" || echo "Not found"

# Windows PowerShell
Select-String -Path generated\passwords.lst -Pattern '^YourPassword$' -SimpleMatch -Quiet

If a real secret matches a generated candidate, change it, enable MFA, and use a password manager. That hit is predictable construction, not a dump from this repo.

---

ML Model

A lightweight ML model ranks generated candidates by structural pattern probability. Train it with local data or the SecLists corpus:

python wlf.py train --auto
python wlf.py train --seclists
python wlf.py train --auto --seclists
python wlf.py train --seclists /path/to/SecLists --seclists-categories password frequency

The model stores only structural patterns: no PII, passwords, or company names.

---

Credits and inspiration

---

Contact

Support / general inquiries: security.research@uniaogeek.com.br Security issues: SECURITY.md

---

André Henrique

União Geek

---

License: BSD-3-Clause License - Copyright (c) 2026 União Geek Created by: André Henrique (@mrhenrike) | União Geek

Leia em Português - Command coverage - Wiki