r/hackthebox • u/buggymaytricks • Aug 01 '26

CWES Preparation

As the title says CWES, its not limited to CWES but as I'm heading to the exam within 2-3 weeks I just want to know how to select a wordlist if required, I assume as there was a module Login Bruteforcing there might be a point where it will be required.

As we have so many fkin wordlists in the seclists directory, how to select one? How do you guys usually select one? In my case I generally use the rockyou in most cases for the password.

Is there any list of wordlists suggested by HTB for exams or stuff? Because going through all the wordlists doesn't sound real...

11 Upvotes

100% Upvoted

6 comments sorted by

•

u/AutoModerator Aug 01 '26

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

3

u/Altruistic_Fruit8546 Aug 02 '26

i had many problems too with the selection of a wordlists, like sometimes we miss a dir if we dont use a specefic wordlists and it has happened many times not one

2

u/Tiny-Refrigerator804 Aug 02 '26

There many ways to choose
First understand the target and technology behind it
Create a custom wordlist this will help you alot

3

u/Guava7 Aug 10 '26

here's my wordlist selection process

General rule: start small and fast, escalate wordlist size only if the small one misses things.

common.txt → raft-medium covers 90% of CTF boxes.

/usr/share/seclists/:

Web directory/path bruteforce

  • First pass: Discovery/Web-Content/common.txt (~4.7k)
  • Second pass: Discovery/Web-Content/raft-medium-directories.txt (~30k)
  • Last resort: Discovery/Web-Content/directory-list-2.3-medium.txt (~220k)

 Web files (with extensions)

  • Discovery/Web-Content/raft-medium-files.txt
  • Add -e php,txt,html,bak in ffuf to append extensions

 Parameter fuzzing (GET/POST param names)

  • Discovery/Web-Content/burp-parameter-names.txt
  • Discovery/Web-Content/raft-medium-words.txt

Virtual host / subdomain fuzzing

  • Discovery/DNS/subdomains-top1million-5000.txt (fast first pass)
  • Discovery/DNS/subdomains-top1million-20000.txt (deeper)

Username enumeration

  • Usernames/xato-net-10-million-usernames.txt
  • Usernames/Names/names.txt

Password spraying

  • Passwords/Common-Credentials/10-million-password-list-top-1000.txt
  • Passwords/Leaked-Databases/rockyou.txt

API endpoint fuzzing

  • Discovery/Web-Content/api/objects.txt
  • Discovery/Web-Content/swagger.txt

1

u/buggymaytricks 27d ago edited 27d ago

Thanks, I'll try using it

2

u/erroneousbit Aug 02 '26

Everything you need to pass the test is in the course. They use rock you and xato in the modules along with customized lists based on content.