Use‐Cases

Use Cases

CredForge output is designed to be consumed by the usual red-team pipeline. All usage below assumes authorized targets.

1. Password Spraying Candidate Lists

# Generate a 10k unique password list, min 10 chars
python3 credforge.py -n 10000 -f 6 -o spray.txt --min-length 10 --unique

# Feed to a spraying tool (e.g. trevorspray, MSOLSpray, custom)
trevorspray --userlist users.txt --passwordlist spray.txt --url https://target/login

Breach-weighting matters here: real users overwhelmingly pick from the common tail, so a frequency-weighted list outperforms a uniform random list on real password policies.

2. Combolist Validation / Tool Testing

python3 credforge.py -n 50000 -f 1 -o combos.txt

• Validate that your account-checking pipeline handles email:pass parsing, unicode, long lines, and dupes.
• Test rate-limiting and lockout logic in a staging environment.

3. Hashcat / John Wordlists

python3 credforge.py -n 200000 -f 6 -o rockyou-like.txt --no-unique --min-length 6

# Use with rules for maximum coverage
hashcat -m 0 hashes.txt rockyou-like.txt -r rules/best64.rule

Format 6 emits one password per line, no separators, no whitespace — hashcat-compatible.

4. Phishing Simulation Credentials

Format 3 or 4 gives a believable identity trail:

james.smith42@gmail.com:Winter1998!:James Smith

Pair with a landing page that validates the creds and logs the "harvest" — SOC detection validation.

5. Database Population

Generate realistic user rows for development/staging databases:

python3 credforge.py -n 1000 -f 4 -c us -o users.csv

Then transform the :-separated lines into your schema.

6. SOC / EDR Detection Validation

Feed generated traffic patterns into detection stacks to validate alerting on credential-stuffing signatures — without using real leaked data.

---

Responsibility: CredForge output is synthetic. Only use against systems you own or are explicitly authorized to test.