CeWL - Custom Wordlist Generator

2 min readArticle

CeWL (Custom Word List generator) is a Ruby-based tool that spiders a target website and harvests unique words to build a custom wordlist. The logic: companies often use internal jargon, product names, and employee names as passwords. Why guess with rockyou.txt when you can scrape the target's own website?

Installation

bash

# Usually pre-installed on Kali
cewl --version

# Install via gem if missing
gem install cewl

Basic Usage

bash

# Spider a website and generate wordlist
cewl https://www.targetcompany.com -w company_wordlist.txt

# Set spider depth (how many links deep to follow)
cewl https://www.targetcompany.com -d 3 -w wordlist.txt

# Set minimum word length (filter out short words)
cewl https://www.targetcompany.com -m 6 -w wordlist.txt

# Include email addresses found on the site
cewl https://www.targetcompany.com --email -w wordlist.txt

# Include meta tags (good for keywords)
cewl https://www.targetcompany.com -a -w wordlist.txt

# Combine options
cewl https://www.targetcompany.com -d 4 -m 7 --email -a -w full_list.txt

Output Verbosely

bash

# See what's happening as it runs
cewl https://www.targetcompany.com -v -w wordlist.txt

# Count words in output
cewl https://www.targetcompany.com | wc -l

Add Mutations with John the Ripper

CeWL output is plain words — combine with JTR rules for mutations:

bash

# Generate CeWL list
cewl https://target.com -m 5 -w cewl_raw.txt

# Apply John rules to create mutations
john --wordlist=cewl_raw.txt --rules --stdout > cewl_mutated.txt

# Or use hashcat rules
hashcat --stdout -r /usr/share/hashcat/rules/best64.rule cewl_raw.txt > cewl_hashcat.txt

Practical Workflow

bash

# 1. Scrape target site
cewl https://corp.target.com -d 3 -m 6 -w corp_words.txt

# 2. Add mutations
john --wordlist=corp_words.txt --rules=best64 --stdout >> corp_words.txt

# 3. Attack with Hydra
hydra -L users.txt -P corp_words.txt ssh://10.10.10.5

# 4. Or offline crack
hashcat -m 1000 hashes.txt corp_words.txt -r /usr/share/hashcat/rules/best64.rule

Tips

Run against multiple subdomains (about page, careers, blog)
The careers/about page often has employee names
Product documentation pages have useful terminology
-d 2 or -d 3 is usually enough; deeper = slower
Always combine with at least basic mutation rules

What to Look For in Output

Employee names (first/last, combined)
Product names, codenames
Industry-specific jargon
Location names (office cities)
Company acronyms

CeWL - Custom Wordlist Generator

Installation

Basic Usage

Output Verbosely

Add Mutations with John the Ripper

Practical Workflow

Tips

What to Look For in Output

See Also