Techzone/RSMangler

RSMangler

2 min readArticle

RSMangler is a wordlist mangling tool that takes an existing wordlist or set of keywords and applies a comprehensive set of transformations to generate password variations. Written in Ruby, it's similar in purpose to WYD but tends to be more aggressive in the number of transformations applied.

Installation

bash 
# Clone from GitHub
git clone https://github.com/digininja/RSMangle
cd RSMangle

# Or check Kali repos
apt search rsmangler

# Run
ruby rsmangler.rb --help

Basic Usage

bash 
# Mangle a single word
echo "password" | ruby rsmangler.rb

# Mangle from file
ruby rsmangler.rb --file keywords.txt --output mangled.txt

# Pipe from CeWL
cewl https://target.com | ruby rsmangler.rb > cewl_mangled.txt

Transformations Applied

RSMangler is comprehensive — it applies all of these by default:

  • Leet speak substitutions — a→4, e→3, i→1, o→0, s→5
  • Capitalization — first letter, all caps, all lower
  • Reversal — password → drowssap
  • Number suffixes — password1, password12, password123, password2024
  • Year suffixes — current year and common years
  • Special char suffixes — password!, password@, password#
  • Doubling — passwordpassword
  • Word combinations — if multiple words provided
  • Common prefixes/suffixes — admin, pass, 123, !@#

Example Output

From input fluffy:

shell 
fluffy
Fluffy
FLUFFY
fluffy1
fluffy12
fluffy123
fluffy2024
fluffy!
f1uffy
flu66y
yffulf
fluffyfluffy
fluffy@

Workflow Examples

Target-Specific Attack

bash 
# 1. Gather keywords from target's website
cewl https://company.com -m 5 -d 2 > company_words.txt

# 2. Add personal info
echo -e "CEO_name\nCityName\nCompanyAbbrev\n2024" >> company_words.txt

# 3. Mangle everything
ruby rsmangler.rb --file company_words.txt > final_wordlist.txt

# 4. Check size
wc -l final_wordlist.txt

# 5. Attack
hashcat -m 1000 ntlm_hashes.txt final_wordlist.txt

Combine with John Rules

bash 
# Generate base from RSMangler
ruby rsmangler.rb --file keywords.txt > rsmangler_out.txt

# Apply additional John rules
john --wordlist=rsmangler_out.txt --rules=best64 --stdout > expanded.txt

Flags / Options

bash 
ruby rsmangler.rb --help
# Common flags:
# --file / -f     Input wordlist
# --output / -o   Output file (default: stdout)
# --min / -m      Minimum word length
# --max / -x      Maximum word length  
# --no-leet       Skip leet transformations
# --no-rev        Skip reversal
# --no-years      Skip year suffixes

When to Use RSMangler vs Others

Tool Best For
RSMangler Aggressive mutation of existing keywords
CeWL Generating base keywords from website
WYD Personal info-based mutations
Crunch Length/charset-based generation
Hashcat rules GPU-accelerated mutation during cracking

Size Warning

RSMangler can produce very large output. For a list of 100 words, expect thousands to tens of thousands of mutations. Filter by length if needed:

bash 
ruby rsmangler.rb --file keywords.txt | awk 'length >= 8 && length <= 20' > filtered.txt

See Also

  • cewl-custom-wordlist-generator - Generate the input wordlist
  • wyd - Personal info based approach
  • crunch-wordlist-generator - Pattern-based generation
  • hashcat-password-cracking-guide - Use the mangled list for cracking
techzonesite.comUnlock Your IT Potential