They attempt dictionary attacks, brute-force, or mask attacks. A "password list" (wordlist) helps a dictionary attack.
There, hidden in the metadata after the text, was a block of invisible characters. It was binary data disguised as whitespace. rar+password+list+for+javakiba