The World is Y0ur$: Geolocation based Wordlist Generation with Wordsmith

## Overview In this presentation, Stan Jeff Kawa and Tom introduce Wordsmith, an open-source tool designed to generate targeted wordlists and usernames using geolocation data. After observing in penetration testing engagements that users frequently incorporate local geographic and cultural references—such as sports teams, landmarks, cities, street names, and religious references—into their passwords, the presenters created Wordsmith to automate the collection and generation of location-specific dictionaries. The talk covers the evolution from version 1 to a ground-up modular rewrite in version 2, detailed data sources, tool architecture, CLI mechanics, and real-world penetration testing case studies.

## Key Topics - **Geolocation-Based Wordlist and Username Generation:** Moving beyond generic dictionary lists to create focused wordlists based on specific countries, states, counties, or cities. Wordsmith also utilizes regional demographic data, such as US Census and Social Security Administration records, to generate plausible user account names for password spraying and enumeration. - **Data Sources and Ingestion:** Leveraging diverse public resources including the CIA World Factbook (demographics, common languages, religions), OpenStreetMap (roads, cities, counties), Project Gutenberg (religious texts such as various editions of the Bible and Quran), Wikipedia (sports teams, universities, landmarks), and spellcheck dictionaries (Hunspell, LibreOffice/OpenOffice) for multilingual wordsets. - **Architecture and Extensibility:** Version 2 organizes data into an ISO alpha-3 flat-file directory structure with YAML configuration files and modular text files per attribute, allowing community contributors to add local data sets easily without needing deep coding experience.

## Technical Details - **CLI Usage and Boundary Selection:** Wordsmith (`wordsmith.rb`) accepts geographic boundaries (`-I`) ranging from entire continents and multi-country aliases defined in a `regions.csv` file, down to ISO country codes, state abbreviations, and specific municipalities. Attributes (`-a` for all, or dedicated flags like `-R` for roads, `-L` for landmarks, `-Z` for zip codes, and `-X` for miscellaneous custom files) define what terms are aggregated. - **Mangling and Filtering Options:** Wordsmith provides flags to enforce minimum or maximum character lengths, perform basic mangling (such as removing punctuation and splitting strings), strip non-compliant strings matching standard password policy complexity rules (`-D` for Windows default complexity requiring 3 of 4 character sets and at least 8 characters), and prepend or append common patterns like area codes, zip codes, or custom year masks. - **Username Generation and Kerb-Guessing:** Using the top 100 first and last names by location, Wordsmith can output common enterprise username permutations (`first.last`, `flast`, etc.). In a demonstrated Active Directory assessment, pre-authentication Kerberos requests ("kerb-guessing") against domain controllers allowed the tester to validate 505 active user accounts out of a generated list without triggering failed authentication lockouts, uncovering nearly half of the organization's valid user accounts. - **Hash Cracking Results:** In an engagement demo targeting an Irish client, an 800,000-word geolocation-focused wordlist was generated in 12 seconds. Paired with Hashcat and the 50,000-rule `dead_hob0` mangling ruleset, it recovered 101 out of 533 unique NTLM hashes (approximately 20%) in roughly 80 seconds, uncovering local street addresses, landmarks, and regional surnames.

## Takeaways - Targeted, location-aware wordlists significantly increase the efficiency and success rate of credential recovery and password spraying against regional and multinational organizations. - Wordsmith version 2 offers a fully modular, community-driven structure across more than 230 countries and territories, supporting multilingual text and custom attributes. - Future plans discussed for version 3 include radius-based wordlist generation via geographic coordinates, API development, and broader integration with OpenStreetMap and lyrics databases.