diff --git a/src/content/notes/network/ftp.md b/src/content/notes/network/ftp.md
index 7e26027..a8825ba 100644
--- a/src/content/notes/network/ftp.md
+++ b/src/content/notes/network/ftp.md
@@ -55,8 +55,8 @@ Check for writable directories: you may be able to upload a webshell if FTP root
 ## Brute Force
 
 ```bash
-hydra -l $user -P /usr/share/wordlists/rockyou.txt ftp://$IP
-medusa -h $IP -u $user -P /usr/share/wordlists/rockyou.txt -M ftp
+hydra -l $user -P ~/wordlists/rockyou.txt ftp://$IP
+medusa -h $IP -u $user -P ~/wordlists/rockyou.txt -M ftp
 ```
 
 Try default credentials first: `admin:admin`, `ftp:ftp`, `user:password`.
diff --git a/src/content/notes/network/telnet.md b/src/content/notes/network/telnet.md
index c1d54ab..5d13d91 100644
--- a/src/content/notes/network/telnet.md
+++ b/src/content/notes/network/telnet.md
@@ -45,8 +45,8 @@ Login with `user` / `password`. Session is fully interactive once authenticated.
 ## Brute Force
 
 ```bash
-hydra -l $user -P /usr/share/wordlists/rockyou.txt telnet://$IP
-medusa -h $IP -u $user -P /usr/share/wordlists/rockyou.txt -M telnet
+hydra -l $user -P ~/wordlists/rockyou.txt telnet://$IP
+medusa -h $IP -u $user -P ~/wordlists/rockyou.txt -M telnet
 ```
 
 Try default credentials first. Routers and embedded devices commonly ship with `admin:admin`, `root:root`, or blank passwords.