Wordlists
Every attack on this page is only as good as the guesses you feed it, so Oniomarchy installs the standard wordlists up front and puts them where the tools expect to find them. These aren’t programs — the menu entries open the wordlist directories in your file manager so you can see what’s there.
What’s installed
| Package | Lives at | What it is |
|---|---|---|
| seclists | /usr/share/doc/seclists |
Daniel Miessler’s SecLists: the big curated collection — passwords, usernames, web-content and DNS discovery lists, fuzzing payloads, and more. Includes rockyou.txt itself (multiple copies, under Passwords/Leaked-Databases/) — there’s no separate rockyou package. |
| wordlists | /usr/share/wordlists |
Arch’s packaged wordlists collection, a convenient central directory. |
Both appear under Security → Password Attacks, and each opens its folder directly.
Using them
Point any cracker or fuzzer at these paths:
# The classic first attempt — rockyou.txt ships inside SecLists
john --wordlist=/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt hashes.txt
hashcat -m 0 -a 0 hashes.txt /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt
# SecLists has purpose-built lists for each job
gobuster dir -u http://10.0.0.5 \
-w /usr/share/seclists/Discovery/Web-Content/common.txt
hydra -l admin \
-P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt \
ssh://10.0.0.5SecLists is the one to get familiar with — it’s organized by task
(Discovery/, Fuzzing/, Passwords/, Usernames/), so there’s usually a
list already shaped for exactly what you’re doing.