CeWL — Custom Word List Generator
Ctrl+F:
cewl·-ddepth ·-mmin length ·-woutput · spider · site wordlist
What is CeWL?
CeWL (Custom Word List generator) spiders a target website, extracts words from HTML/text, and writes a custom wordlist — names, product terms, jargon from that site. Much more targeted than generic rockyou.txt for password guessing against users you found on that domain.
OSCP use: After finding a web app or company site →
cewl→ feed list to Hydra, Hashcat rules, or Gobuster / ffuf for site-specific paths/passwords.
Install (Kali)
sudo apt update && sudo apt install -y cewl
which cewl
cewl --help→ Installation - Kali Setup > 📌 Password attacks
Syntax
cewl [options] <URL>
cewl [options] -w output.txt <URL>📌 1) Key Flags
| Flag | Description |
|---|---|
-w <file> | Write wordlist to file |
-d <n> | Spider depth (default 2) |
-m <n> | Minimum word length (default 3) |
-x <n> | Maximum word length |
-e | Extract email addresses found on pages |
-a | Parse <meta> author/tags |
-n | No output to stdout (file only with -w) |
--lowercase / -l | Lowercase all words |
-u <user> | HTTP basic auth username |
-p <pass> | HTTP basic auth password |
--auth-user / --auth-pass | Same (long form) |
-c <cookie> | Cookie string |
-H <header> | Custom header (repeatable) |
--proxy <host:port> | Proxy (e.g. Burp 127.0.0.1:8080) |
-v | Verbose spider |
-g <n> | Number of spider groups (threads) |
--with-number | Append numbers to words |
-k | Keep spidering on errors |
--offsite | Allow off-site links in spider |
📌 2) Basic Usage
# Spider site — print words to terminal
cewl http://TARGET/
# Save to file
cewl -w cewl_TARGET.txt http://TARGET/
# Deeper crawl + min word length 5
cewl -d 3 -m 5 -w cewl.txt http://TARGET/
# HTTPS + lowercase
cewl --lowercase -w cewl.txt https://TARGET/
# Extract emails too (usernames for spray)
cewl -e -w cewl_emails.txt http://TARGET/📌 3) OSCP Workflows
Site-specific password list → Hydra
# 1. Build list from company blog / login page
cewl -d 2 -m 4 -w cewl.txt http://dc2.local/
# 2. Sort unique
sort -u cewl.txt -o cewl_clean.txt
# 3. Spray SSH / web login
hydra -l tom -P cewl_dc2.txt ssh://TARGET
hydra -l admin -P cewl_dc2.txt http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"Combine with rockyou (prepend site words)
cewl -w site_words.txt http://TARGET/
cat site_words.txt /usr/share/wordlists/rockyou.txt > combined.txt
hashcat -m 1800 hash.txt combined.txtAuthenticated spider
cewl -u admin -p password -w cewl.txt http://TARGET/admin/
cewl -c "session=abc123" -w cewl.txt http://TARGET/Through Burp
cewl --proxy 127.0.0.1:8080 -w cewl.txt http://TARGET/📌 4) CeWL vs other wordlist tools
| Tool | Source | Best for |
|---|---|---|
| CeWL | Live website text | Passwords / terms from that org |
| Gobuster / ffuf | Static wordlist files | Hidden paths / vhosts |
| rockyou | Generic leak list | Broad offline crack |
| Kerbrute userenum | LDAP/Kerberos | AD usernames (not site spider) |
CeWL output is often noisy — always sort -u, consider -m 5, and manually review top terms.
📌 5) Post-processing
# Unique + sorted
sort -u cewl.txt -o cewl.txt
# Remove numbers-only / too short
grep -E '^[a-zA-Z]{4,}' cewl.txt > cewl_clean.txt
# Count
wc -l cewl.txt
# Mutate with hashcat rules
hashcat --stdout cewl.txt -r /usr/share/hashcat/rules/best64.rule > cewl_mutated.txt→ Text Processing · sort · grep
📌 Quick Cheat Sheet
cewl -w cewl.txt http://TARGET/
cewl -d 3 -m 5 -e --lowercase -w cewl.txt http://TARGET/
cewl -u user -p pass -w cewl.txt http://TARGET/secure/
sort -u cewl.txt -o cewl.txt
hydra -l USER -P cewl.txt ssh://TARGET