CeWL — Custom Word List Generator

CeWL spiders a website and extracts unique strings to build a custom wordlist. The list can feed password crackers like Hashcat or John the Ripper, or be used for directory brute-forcing and content discovery.

Installation

# Kali Linux
sudo apt install cewl
 
# From source (Ruby required)
git clone https://github.com/digininja/CeWL.git
cd CeWL
bundle install

Basic usage

cewl -w $OUTPUT_FILE \
     -d $DEPTH_TO_SPIDER \
     -m $MINIMUM_STRING_LENGTH \
        $URL

Key options

Flag	Purpose
-w FILE	Write output to file
-d N	Spider depth (default: 2)
-m N	Minimum word length (default: 3)
-x N	Maximum word length
-o	Allow offsite links
-e FILE	Include email addresses
-a FILE	Include metadata (author, etc.)
-c	Show word count per entry
-u AGENT	Custom User-Agent
--auth_type	HTTP basic/digest authentication

Operational note

CeWL is most useful against company websites, marketing pages, and documentation — the vocabulary reveals internal project names, product codenames, and employee jargon that generic wordlists miss.

Sources

• CeWL — Custom Word List Generator — digininja/CeWL (GitHub)
• cewl — Kali Linux Tools
• CeWL — Custom Word List Generator — DigiNinja Project Page

Related: cupp-common-user-passwords-profiler, john-the-ripper, linux-reconnaissance-commands, ffuf, gobuster