Having knowledge about password rules applied to a system is typically a good way. Let's say a service require a legitimate password to be between 6-10 alphanumeric characters with at least one number. You can get a grip on the rules by registering in that system (if this is possible) or apply some domain knowledge of this system.
So without this knowledge there is in deed no way of generating dictionaries in a efficient way.
If you can prune 500.000.000 passwords that are <6 or >10 or having no number in it, you have already won. Converting everything to leet speak does not automatically help when the system in question does dissallow backslashes for instance.
(On the other hand as an administrator: hiding those rules from the legitimate user will really annoy them)
But there is a way of generating a full list, you don't even need any word lists for that, that is a simple brute force attack over the entire character space beginning with 1 up to some limit, lets say a password limit of 256. Then you will have the guaranteed "word list". The amount of garbage data is of course enormous but it might be as well as enormous when using leet speak on a server disallowing those chars.