I Know What Your Password Was Last Summer...

use a collection of custom and standard wordlists when targeting organisations. The standard public lists we try with various rules are shown:

• HaveIBeenPwned password list from PwnedPasswords (https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader)
• Common Corp Passwords (https://github.com/danielmiessler/SecLists/blob/master/Passwords/common_corporate_passwords.lst)
• English Dictionary (https://github.com/dwyl/english-words/blob/master/words.txt)
• Crackstation (https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm)
• Antipublic (https://bigpasswordlist.com/DAAP.html)
• Weakpass_3a (https://weakpass.com/wordlist/1948)

As for rulesets, we use public and private ones again, but here are the public ones we use:

• OneRuleToRuleThemAll (https://github.com/NotSoSecure/password_cracking_rules)
• OneRuleToRuleThemStill (https://github.com/stealthsploit/OneRuleToRuleThemStill)
• Pantagrule (https://github.com/rarecoil/pantagrule/tree/master/rules/private.hashorg.royce)

https://github.com/danielmiessler/SecLists/tree/master/Passwords/