← retour aux outils back to tools

# cewl

Générateur de wordlist personnalisée qui spidere les sites web et en extrait les mots. Crée des listes de mots de passe ciblées à partir du propre contenu web d'une cible : bien plus efficace que les wordlists génériques. Custom wordlist generator that spiders websites and extracts words. Creates targeted password lists from a target's own web content — much more effective than generic wordlists.

↗ https://github.com/digininja/CeWL

## Overview

cewl crawls a target website and extracts unique words to build a custom wordlist. Since organizations use domain-specific terminology in passwords (company name, products, internal jargon), wordlists generated from their own website significantly improve cracking success rates compared to generic lists like rockyou.

## Basic Usage

Basic crawl and wordlist generation

    cewl https://example.com

Save to file

    cewl https://example.com -w wordlist.txt

Set crawl depth (default: 2)

    cewl https://example.com -d 3 -w wordlist.txt

Minimum word length (default: 3)

    cewl https://example.com -m 6 -w wordlist.txt

Include numbers

    cewl https://example.com --with-numbers -w wordlist.txt

Include email addresses found on site

    cewl https://example.com -e -w wordlist.txt

## Meta Tag and Auth

Include meta description content

    cewl https://example.com --meta -w wordlist.txt

HTTP Basic Auth

    cewl https://example.com --auth_type basic --auth_user admin --auth_pass secret

With cookies for authenticated pages

    cewl https://example.com --header "Cookie: session=abc123"

Follow offsite links

    cewl https://example.com --offsite

## Advanced Options

Combine with mutations for more variants

    cewl https://example.com -w base.txt

Create wordlist with min 8 chars

    cewl https://example.com -m 8 -w wordlist.txt

Verbose (show words as they’re found)

    cewl https://example.com -v -w wordlist.txt

Debug (show crawl activity)

    cewl https://example.com --debug

## Post-Processing Wordlists

    # Append common suffixes (year, !, 123)
    cat wordlist.txt | while read w; do
        echo "$w"
        echo "${w}123"
        echo "${w}!"
        echo "${w}2024"
        echo "${w}@123"
    done > wordlist_expanded.txt

Generate case variations with john

    john --wordlist=wordlist.txt --rules --stdout > wordlist_mangled.txt

Combine with hashcat rules

    hashcat -a 0 -m 0 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule

## Use Cases

Generate list for password spray

    cewl https://company.com -m 5 -d 2 -w company_words.txt

Then spray against OWA / Office365

    spray -t https://mail.company.com -u users.txt -p company_words.txt

Or against SMB

    crackmapexec smb 10.10.10.1 -u users.txt -p company_words.txt

Crack captured hashes with custom list

    hashcat -m 1000 hashes.txt company_words.txt

## Tips

- Set `-m 6` or higher to skip short words that rarely appear in passwords
- Use `--with-numbers` to include version numbers, years, etc.
- Crawl the company’s LinkedIn, careers page, and blog — lots of unique terminology
- Combine the CeWL output with `john --rules` for mutated variants

Help / Man page

    cewl [options] <url>

    -d N            Depth (default: 2)
    -m N            Minimum word length (default: 3)
    -w FILE         Output file
    -e              Include email addresses
    --meta          Include meta tag content
    --offsite       Follow offsite links
    --with-numbers  Include words with numbers
    --auth_type T   Auth type: basic or digest
    --auth_user U   Username for auth
    --auth_pass P   Password for auth
    --proxy PROXY   Proxy URL
    --header H      Add header (repeatable)
    -v              Verbose
    --debug         Debug output

## Vue d’ensemble

cewl parcourt un site web cible et en extrait les mots uniques pour construire une wordlist personnalisée. Comme les organisations emploient dans leurs mots de passe une terminologie propre à leur domaine (nom de l’entreprise, produits, jargon interne), les wordlists générées depuis leur propre site améliorent nettement les taux de réussite de crack par rapport aux listes génériques comme rockyou.

## Utilisation de base

    # Crawl de base et génération de wordlist
    cewl https://example.com

    # Sauvegarder dans un fichier
    cewl https://example.com -w wordlist.txt

    # Définir la profondeur de crawl (défaut : 2)
    cewl https://example.com -d 3 -w wordlist.txt

    # Longueur minimale de mot (défaut : 3)
    cewl https://example.com -m 6 -w wordlist.txt

    # Inclure les nombres
    cewl https://example.com --with-numbers -w wordlist.txt

    # Inclure les adresses e-mail trouvées sur le site
    cewl https://example.com -e -w wordlist.txt

## Meta tags et authentification

    # Inclure le contenu de la meta description
    cewl https://example.com --meta -w wordlist.txt

    # HTTP Basic Auth
    cewl https://example.com --auth_type basic --auth_user admin --auth_pass secret

    # Avec des cookies pour les pages authentifiées
    cewl https://example.com --header "Cookie: session=abc123"

    # Suivre les liens externes
    cewl https://example.com --offsite

## Options avancées

    # Combiner avec des mutations pour plus de variantes
    cewl https://example.com -w base.txt

    # Créer une wordlist avec min 8 caractères
    cewl https://example.com -m 8 -w wordlist.txt

    # Verbeux (afficher les mots au fur et à mesure)
    cewl https://example.com -v -w wordlist.txt

    # Debug (afficher l'activité de crawl)
    cewl https://example.com --debug

## Post-traitement des wordlists

    # Ajouter des suffixes courants (année, !, 123)
    cat wordlist.txt | while read w; do
        echo "$w"
        echo "${w}123"
        echo "${w}!"
        echo "${w}2024"
        echo "${w}@123"
    done > wordlist_expanded.txt

    # Générer des variations de casse avec john
    john --wordlist=wordlist.txt --rules --stdout > wordlist_mangled.txt

    # Combiner avec les règles hashcat
    hashcat -a 0 -m 0 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule

## Cas d’usage

    # Générer une liste pour du password spray
    cewl https://company.com -m 5 -d 2 -w company_words.txt

    # Puis sprayer contre OWA / Office365
    spray -t https://mail.company.com -u users.txt -p company_words.txt

    # Ou contre le SMB
    crackmapexec smb 10.10.10.1 -u users.txt -p company_words.txt

    # Cracker des empreintes capturées avec la liste personnalisée
    hashcat -m 1000 hashes.txt company_words.txt

## Conseils

- Mettez `-m 6` ou plus pour ignorer les mots courts qui apparaissent rarement dans les mots de passe
- Utilisez `--with-numbers` pour inclure numéros de version, années, etc.
- Crawlez le LinkedIn de l’entreprise, sa page carrières et son blog : beaucoup de terminologie unique
- Combinez la sortie de CeWL avec `john --rules` pour des variantes mutées

Aide / Page de manuel

    cewl [options] <url>

    -d N            Depth (default: 2)
    -m N            Minimum word length (default: 3)
    -w FILE         Output file
    -e              Include email addresses
    --meta          Include meta tag content
    --offsite       Follow offsite links
    --with-numbers  Include words with numbers
    --auth_type T   Auth type: basic or digest
    --auth_user U   Username for auth
    --auth_pass P   Password for auth
    --proxy PROXY   Proxy URL
    --header H      Add header (repeatable)
    -v              Verbose
    --debug         Debug output