A municipal WLAN lab builds a custom dictionary of local street names and civic landmarks for an authorized guest-PSK recovery test. Why can that targeted list outperform a generic rockyou-style dump?

Building a custom dictionary of local street names and civic landmarks for an authorized municipal WLAN lab addresses organization-themed passphrase habits: localized dictionaries often match agency naming patterns better than huge generic lists alone. City staff historically pick park names, building names, and event slogans. Assessors still keep such lists inside the engagement and do not treat possession of a wordlist as authorization to attack neighbors.

'Street-name lists automatically break WPA3-SAE without needing any handshake capture' fails because street-name lists do not automatically break WPA3-SAE without handshake or equivalent material. 'Generic wordlists are illegal to use on Kali during OffSec-style wireless exams' fails because generic wordlists are not illegal on Kali merely by existing; constraints come from exam/RoE rules about which lists you may use. 'Targeted lists force the access point CPU to validate every guess in real time' fails because targeted lists do not force the AP CPU to validate every guess in real time—that confuses offline cracking with online guessing.

Exam caveat: a clever local list still fails against high-entropy random PSKs—and still must stay in-scope. Operational check: assemble civic-pattern candidates approved for the engagement, merge with allowed base lists/rules, run against validated in-scope captures, and cite the custom list name in the report methodology. Store the list with engagement data rather than posting it publicly with live keys. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.