Password Attacks
CeWL is a custom word list generator that spiders a target URL and creates a wordlist from the content. Great for targeted password attacks.
sudo apt install cewl
cewl <url>
CeWL (Custom Word List generator) is a Ruby-based tool that spiders a target website and generates a custom wordlist from the content it finds. Unlike generic wordlists, CeWL creates dictionaries tailored to the specific target organization.
By crawling the target website to a specified depth, CeWL extracts words from page content, including company names, product terms, employee names, and industry jargon. This produces wordlists far more effective than generic lists for password attacks against that specific organization.
CeWL also supports email extraction, making it useful for username enumeration. Combined with password mutation rules in tools like John the Ripper or Hashcat, CeWL-generated wordlists significantly improve password cracking success rates.
cewl example.comSpider a site with default settings and print a wordlist to stdoutcewl -w wordlist.txt example.comWrite the harvested wordlist to a file instead of the screencewl -d 3 example.comIncrease the spidering depth to 3 links deep (default is 2)cewl -d 0 -w page.txt example.comScrape only the single supplied page (no link following)cewl -m 6 example.comOnly keep words that are at least 6 characters longcewl -m 5 -d 2 -w wordlist.txt example.comCommon combo: depth 2, minimum length 5, output to filecewl -c example.comShow the occurrence count next to each word foundcewl --lowercase example.comConvert every parsed word to lowercasecewl --with-numbers example.comAlso accept words that contain digits, not just letterscewl -o example.comAllow the spider to follow links to other (offsite) domainscewl -k example.comKeep the downloaded pages/files on disk after spideringcewl -e example.comExtract and include email addresses found on the sitecewl -e --email_file emails.txt example.comHarvest emails and write them to a dedicated filecewl -n -e example.comSkip the wordlist and only output the discovered email addressescewl -a example.comInclude document metadata (author, software) via exiftool parsingCreate wordlists using company-specific terms, products, and jargon from their website.
Extract email addresses from websites to build username lists for brute-force attacks.
Gather words and phrases for crafting targeted phishing emails and social engineering attacks.
Generate custom dictionaries for CTF challenges based on challenge-related websites.
Build target-specific password lists for more effective credential attacks.
Password Attacks
Pattern-based wordlist generator for creating wordlists from character sets and patterns.
Password Attacks
Password cracker that uses CeWL-generated wordlists with rules for effective cracking.
Password Attacks
GPU-accelerated cracker for maximum speed with CeWL-generated wordlists.
Password Attacks
Pattern-based wordlist generator for supplementing CeWL output.
Password Attacks
Online brute-forcer for testing CeWL-generated passwords against live services.
Generates a localized text file containing words scraped directly from the provided web pages.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.