retour aux outils back to tools Ducklings

cewl

Générateur de wordlist personnalisée qui spidere les sites web et en extrait les mots. Crée des listes de mots de passe ciblées à partir du propre contenu web d'une cible : bien plus efficace que les wordlists génériques. Custom wordlist generator that spiders websites and extracts words. Creates targeted password lists from a target's own web content — much more effective than generic wordlists.

↗ https://github.com/digininja/CeWL

Overview

cewl crawls a target website and extracts unique words to build a custom wordlist. Since organizations use domain-specific terminology in passwords (company name, products, internal jargon), wordlists generated from their own website significantly improve cracking success rates compared to generic lists like rockyou.

Basic Usage

Basic crawl and wordlist generation

cewl https://example.com

Save to file

cewl https://example.com -w wordlist.txt

Set crawl depth (default: 2)

cewl https://example.com -d 3 -w wordlist.txt

Minimum word length (default: 3)

cewl https://example.com -m 6 -w wordlist.txt

Include numbers

cewl https://example.com --with-numbers -w wordlist.txt

Include email addresses found on site

cewl https://example.com -e -w wordlist.txt

Meta Tag and Auth

Include meta description content

cewl https://example.com --meta -w wordlist.txt

HTTP Basic Auth

cewl https://example.com --auth_type basic --auth_user admin --auth_pass secret

With cookies for authenticated pages

cewl https://example.com --header "Cookie: session=abc123"

Follow offsite links

cewl https://example.com --offsite

Advanced Options

Combine with mutations for more variants

cewl https://example.com -w base.txt

Create wordlist with min 8 chars

cewl https://example.com -m 8 -w wordlist.txt

Verbose (show words as they’re found)

cewl https://example.com -v -w wordlist.txt

Debug (show crawl activity)

cewl https://example.com --debug

Post-Processing Wordlists

# Append common suffixes (year, !, 123)
cat wordlist.txt | while read w; do
    echo "$w"
    echo "${w}123"
    echo "${w}!"
    echo "${w}2024"
    echo "${w}@123"
done > wordlist_expanded.txt

Generate case variations with john

john --wordlist=wordlist.txt --rules --stdout > wordlist_mangled.txt

Combine with hashcat rules

hashcat -a 0 -m 0 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule

Use Cases

Generate list for password spray

cewl https://company.com -m 5 -d 2 -w company_words.txt

Then spray against OWA / Office365

spray -t https://mail.company.com -u users.txt -p company_words.txt

Or against SMB

crackmapexec smb 10.10.10.1 -u users.txt -p company_words.txt

Crack captured hashes with custom list

hashcat -m 1000 hashes.txt company_words.txt

Tips

  • Set -m 6 or higher to skip short words that rarely appear in passwords
  • Use --with-numbers to include version numbers, years, etc.
  • Crawl the company’s LinkedIn, careers page, and blog — lots of unique terminology
  • Combine the CeWL output with john --rules for mutated variants
Help / Man page 
cewl [options] <url>

-d N            Depth (default: 2)
-m N            Minimum word length (default: 3)
-w FILE         Output file
-e              Include email addresses
--meta          Include meta tag content
--offsite       Follow offsite links
--with-numbers  Include words with numbers
--auth_type T   Auth type: basic or digest
--auth_user U   Username for auth
--auth_pass P   Password for auth
--proxy PROXY   Proxy URL
--header H      Add header (repeatable)
-v              Verbose
--debug         Debug output

Vue d’ensemble

cewl parcourt un site web cible et en extrait les mots uniques pour construire une wordlist personnalisée. Comme les organisations emploient dans leurs mots de passe une terminologie propre à leur domaine (nom de l’entreprise, produits, jargon interne), les wordlists générées depuis leur propre site améliorent nettement les taux de réussite de crack par rapport aux listes génériques comme rockyou.

Utilisation de base

# Crawl de base et génération de wordlist
cewl https://example.com

# Sauvegarder dans un fichier
cewl https://example.com -w wordlist.txt

# Définir la profondeur de crawl (défaut : 2)
cewl https://example.com -d 3 -w wordlist.txt

# Longueur minimale de mot (défaut : 3)
cewl https://example.com -m 6 -w wordlist.txt

# Inclure les nombres
cewl https://example.com --with-numbers -w wordlist.txt

# Inclure les adresses e-mail trouvées sur le site
cewl https://example.com -e -w wordlist.txt

Meta tags et authentification

# Inclure le contenu de la meta description
cewl https://example.com --meta -w wordlist.txt

# HTTP Basic Auth
cewl https://example.com --auth_type basic --auth_user admin --auth_pass secret

# Avec des cookies pour les pages authentifiées
cewl https://example.com --header "Cookie: session=abc123"

# Suivre les liens externes
cewl https://example.com --offsite

Options avancées

# Combiner avec des mutations pour plus de variantes
cewl https://example.com -w base.txt

# Créer une wordlist avec min 8 caractères
cewl https://example.com -m 8 -w wordlist.txt

# Verbeux (afficher les mots au fur et à mesure)
cewl https://example.com -v -w wordlist.txt

# Debug (afficher l'activité de crawl)
cewl https://example.com --debug

Post-traitement des wordlists

# Ajouter des suffixes courants (année, !, 123)
cat wordlist.txt | while read w; do
    echo "$w"
    echo "${w}123"
    echo "${w}!"
    echo "${w}2024"
    echo "${w}@123"
done > wordlist_expanded.txt
# Générer des variations de casse avec john
john --wordlist=wordlist.txt --rules --stdout > wordlist_mangled.txt

# Combiner avec les règles hashcat
hashcat -a 0 -m 0 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule

Cas d’usage

# Générer une liste pour du password spray
cewl https://company.com -m 5 -d 2 -w company_words.txt

# Puis sprayer contre OWA / Office365
spray -t https://mail.company.com -u users.txt -p company_words.txt

# Ou contre le SMB
crackmapexec smb 10.10.10.1 -u users.txt -p company_words.txt

# Cracker des empreintes capturées avec la liste personnalisée
hashcat -m 1000 hashes.txt company_words.txt

Conseils

  • Mettez -m 6 ou plus pour ignorer les mots courts qui apparaissent rarement dans les mots de passe
  • Utilisez --with-numbers pour inclure numéros de version, années, etc.
  • Crawlez le LinkedIn de l’entreprise, sa page carrières et son blog : beaucoup de terminologie unique
  • Combinez la sortie de CeWL avec john --rules pour des variantes mutées
Aide / Page de manuel 
cewl [options] <url>

-d N            Depth (default: 2)
-m N            Minimum word length (default: 3)
-w FILE         Output file
-e              Include email addresses
--meta          Include meta tag content
--offsite       Follow offsite links
--with-numbers  Include words with numbers
--auth_type T   Auth type: basic or digest
--auth_user U   Username for auth
--auth_pass P   Password for auth
--proxy PROXY   Proxy URL
--header H      Add header (repeatable)
-v              Verbose
--debug         Debug output