In order to crack a password, you need to have a list of credentials that you can try. You can utilize a user list (which contains usernames only), a password list (which contains passwords only), or a list that combines the two.
Userlists is a list that contains usernames. It can be built by performing reconnaissance on your target, or, in some cases, it may be provided to you for the penetration test. If you need to build your own userlist, there are some questions to consider. Is the target using firstname.lastname as the username? Perhaps the target's username is the same as their email address? A good way to find usernames is looking at the metadata of files publicly posted on the internet. You can use a simple Google query to find specific file types, using the filetype: search string.
