CeWL — Password Attacks | Tools

Description

CeWL (Custom Word List generator) spiders a target URL to a specified depth and returns a list of words that can be used as passwords. Extremely useful for generating targeted wordlists.

Installation

                        BASH
                        
                            # Kali (pre-installed)
cewl -h

# Debian/Ubuntu
sudo apt install cewl

# Ruby gem
gem install cewl

Basic Usage

                        BASH
                        
                            # Generate wordlist from URL
cewl https://target.com -w wordlist.txt

# Spider depth
cewl https://target.com -d 3 -w wordlist.txt

# Minimum word length
cewl https://target.com -m 6 -w wordlist.txt

Advanced Usage

                        BASH
                        
                            # Include email addresses
cewl https://target.com -e -w wordlist.txt

# Count word occurrences
cewl https://target.com -c -w wordlist.txt

# Include numbers in words
cewl https://target.com -n -w wordlist.txt

# Authentication
cewl https://target.com --auth_type basic --auth_user admin --auth_pass password -w wordlist.txt

# Follow external links
cewl https://target.com --offsite -d 2 -w wordlist.txt

Common Workflows

                        BASH
                        
                            # Generate wordlist then brute force
cewl https://target.com -d 3 -m 5 -w custom_words.txt
hydra -l admin -P custom_words.txt target.com http-post-form "/login:user=^USER^&pass=^PASS^:F=Invalid"

# Combine with rules in hashcat
cewl https://target.com -d 3 -m 5 -w base.txt
hashcat -m 0 hashes.txt base.txt -r /usr/share/hashcat/rules/best64.rule