Hack Like a Pro: How to Crack Passwords, Part 5 (Creating a Custom Wordlist with CeWL) « Null Byte :: WonderHowTo

Welcome back, my novice hackers!In my series oncracking passwords, I began by showing off some basicpassword-cracking principles; developed anefficient password-cracking strategy; demonstrated how to useHashcat, one of the most powerful password-cracking programs; and showed how to create a custom wordlist usingCrunch. In this tutorial, I will show you how to create a custom wordlist based upon the industry or business of the targets usingCeWL.Most password-cracking programs are only as good as the wordlist that you provide them. Brute-force password cracking is very tedious and time consuming, but if you can find an appropriate and well-designed wordlist that is specific to the user whose password you are trying to crack, you can save yourself hours—maybe even days—of password cracking.Crunch is great at creating wordlists based upon a set of rules such as the number of characters, the character set, etc., but doesn't enable us to choose a wordlist that is particular to a business or industry or interests. We humans are not always very creative and often fall victim to the familiar,especially when generating passwords. If we understand that, it can be helpful to finding potential passwords and generating a relevant password list.For instance, employees at a construction company are more likely to use words for passwords that are used in their industry, such as lumber, girder, build, soffit, eave, etc. People in the drug industry are more likely have passwords such as prescription, drug, narcotic, barbiturate, etc. You get the idea.It's simply human nature that words that we use in our everyday experience will first pop into our heads when we are considering passwords. That's why so many people use their pet's name, spouse's names, children's names, birthdates, street address, anniversaries, etc. They aren't very creative and use words and numbers that first come to mind.We can use this lack of creativity to develop a specific wordlist for a specific company or industry. That's what CeWL can do for us. It's designed to grab words from the company's website to create a wordlist specific to the company in order to crack passwords of the users at that business.Let's get started.Step 1: Fire Up Kali & CeWL HelpFirst, fire up Kali and open a terminal. Next, let's type the "cewl" command and get its help screen.kali > cewl --helpNote the depth (-d) and the min_word_length (-m) switches. The -d switch determines how deep (the default is 2) into the website CeWL will crawl grabbing words, and the -m switch determines the minimum length of words it will grab. Since most firms have a minimum password length, there's no need to grab short words. In this case, I will be setting the minimum to 7 letters.Step 2: Build a Custom List with CeWLNow, to build a custom wordlist, we set CeWL to scraping words from the website of our friends atSANS Institute. We can do this by typing:kali > cewl -w customwordlist.txt -d 5 -m 7www.sans.orgLet's break that down.-w customwordlist.ext: the -w means write to the file name that follows.-d 5: the depth (in this case, 5) that CeWL will crawl to website.-m 7: the minimum word length; in this case it will grab words of 7 characters minimum.www.sans.org: the website we are crawling.This command will then crawl the sans.org website to a depth of 5 pages, grabbing words at least 7 letters long. After several hours of crawling through the website, CeWL places all of the words it found into the filecustomwordlist.txt. We can then open it with any text editor; in this case, we will use Leafpad.kali > leafpad customwordlist.txtThis will open the file like that below.Note that these words are a reflection of the industry that SANS Institute is in—information security.Step 3: Combine This List with a List Generated by CrunchNow, combine this wordlist with another wordlist, or onegenerated by Crunch. Place these words first as they are specific to this user or company and are more likely to be correct.Of course, we can use CeWL to create custom wordlists for password cracking targets other than employees at a particular company. For instance, if we know the individual who is our target is a soccer fan, we use CeWL to crawl a soccer site to grab soccer related words. That is, we can use CeWL to create specific password lists based upon just about any subject area by simply crawling a website to grab potential keywords.Stay tuned: we will continue to explore new and better ways to crack passwords inthis series, so keep coming back, my novice hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHow To:Use Wordlister to Create Custom Password Combinations for CrackingHack Like a Pro:How to Crack Passwords, Part 4 (Creating a Custom Wordlist with Crunch)How To:Create Custom Wordlists for Password Cracking Using the MentalistHack Like a Pro:How to Crack Online Web Form Passwords with THC-Hydra & Burp SuiteHow To:Creating Unique and Safe Passwords, Part 1 Using WordlistsHow To:Automate Brute-Force Attacks for Nmap ScansHow To:Use Acccheck to Extract Windows Passwords Over NetworksHack Like a Pro:How to Crack Passwords, Part 3 (Using Hashcat)How To:Brute-Force Email Using a Simple Bash Script (Ft. THC Hydra)How To:Hack WPA/WPA2-Enterprise Part 2How To:Crack MD5 Hashes with All of Kali Linux's Default WordlistsHack Like a Pro:How to Crack Private & Public SNMP Passwords Using OnesixtyoneHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords with CowpattyHack Like a Pro:How to Crack Passwords, Part 2 (Cracking Strategy)How To:Crack Shadow Hashes After Getting Root on a Linux SystemHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHack Like a Pro:How to Grab & Crack Encrypted Windows PasswordsHack Like a Pro:How to Crack Online Passwords with Tamper Data & THC HydraAdvice from a Real Hacker:How to Create Stronger PasswordsHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Hacking macOS:How to Hack a Mac Password Without Changing ItHack Like a Pro:How to Crack Passwords, Part 1 (Principles & Technologies)News:Advanced Cracking Techniques, Part 1: Custom DictionariesGoodnight Byte:Coding a Web-Based Password Cracker in PythonNews:Advanced Cracking Techniques, Part 2: Intelligent BruteforcingHow To:How Hackers Take Your Encrypted Passwords & Crack ThemRainbow Tables:How to Create & Use Them to Crack PasswordsHow To:GPU Accelerate Cracking Passwords with HashcatMastering Security, Part 1:How to Manage and Create Strong PasswordsHow To:Hack Mac OS X Lion Passwords