Hello,

I am learning about online attack using Hydra. I have Hydra installed and already tried running some example password lists on my machine. Now, how to generate a password list?

The zxcvbn password strength estimator estimates that a password such as ‘helenxing’ takes 10 hours to attack at 10 guesses/hr (https://lowe.github.io/tryzxcvbn/) for unthrottled online attack. However, there is obviously no existing password list with the password ‘helenxing’. So how should I go about launching the attack?

How can I combine functionalities of HashCat (which takes different dictionaries and combines and mutates them) and functionalities of Hydra? And how can I combine the generated word list with lists like rockyou.txt? The final password list should ideally have the most frequent passwords first.