Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog
A Detailed Guide on Cewl

Hi, Pentesters! In this article we are going to focus on the Kali Linux tool “Cewl” which will basically help you to create a wordlist. Let’s explore this tool and learn about what all other options this tool provides.

Table of Contents:Introduction to Cewl: A custom wordlist generator is a ruby program that crawls a specific URL to a defined depth and returns a list of keywords, which password crackers like John the Ripper, Medusa, WFuzz can use to crack the passwords. Cewl also has an associated command line app FAB, which uses same metadata extraction techniques to generate author/producer lists from already downloaded files using information extraction algorithms like CeWL.Syntax: cewl ___________________________
@hacking_Attack
@Hacking_Video

Blogspot

A Detailed Guide on Cewl

Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.

3 viewsedited 20:15

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog A Detailed Guide on Cewl Hi, Pentesters! In this article we are going to focus on the Kali Linux tool “Cewl” which will basically help you to create a wordlist. Let’s explore this tool and learn about what all other options…

Proxy port, default 8080.Default Procedure:Use the following command to generate a list of words which will spider the given URL to specified depth and we can use it as directory for cracking the passwords.Store this wordlist in a file:Now to save this all wordlist in file for record keeping, efficiency and readability we will use -w option to save the output in a text file.Generating wordlists of certain length:If you want to create a wordlist of specific length than you can choose to use option -m and provide the minimum length for the keyword and hence it will create wordlists for certain length.Retrieval of Emails from website:In order to retrieve emails from the website we can use -e option, while -n option will hide the lists of created while crawling the provided website. As you can see in the screenshot attached it has found 1 email-id from the website.To count number of words repeated in website:If you want to count number of times a word is repeated in a website, then use -c option that will enable count parameter.Increase Spider depth:You can use -d option with depth number to activate depth parameter for more quick and intense crawling so that a large list of words is created. The depth level is set to 2 as default.___________________________
@hacking_Attack
@Hacking_Video

2 viewsedited 20:15

Hacking Articles Tips Tricks Videos Tutorials

TFxG6GNaAA2Pd1b2ZnaVhRFh8n-L1E6OGSt_SNq2ktctYAyJCzqdPfFpzqEv4goxvmMj_18lStAPKKp5TpjxA/s16000/8.png Verbose Mode:We have a -v option for the verbose mode to extend the website crawling result and retrieving complete detail of website. Alphanumeric Wordlist:Sometimes it may happen that you may need a alpha-numeric wordlist for that you can use –with-numbers option to get a alpha-numeric wordlist.https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMM2RyA99wESJEydORlpN52PTw7UQ4_fjz0OzYouBmvJIBH5yosOjZ1zGqbHTOsMkLlTa-6MoNEdgcUk2cqhUjbD94ywqdON81AWUoshDtS1olrJh67vQPlmG0-_TXnLYNRIKto3rUCIHoqXkH2FD5m0d_JSq7_vRBOZIOtvl3cK8CPg09QAwV6a0VvA/s16000/11.png Cewl with Digest/Basic Authentication:It may happen sometime that some web application may have a authentication page for login and for that the above basic command will not give desired results. So for that you need to bypass the authentication page by using command given below.Lowercase all parsed words:When you need the keywords to be generated in lowercase for that you can use --lowercase option to generate the words in lowercase.Proxy Support:This default command for cewl will not work properly if you have attached a proxy server. We tried to access the application through ip address but proxy server is attached hence this gave us Forbidden Error page.___________________________
@hacking_Attack
@Hacking_Video

3 viewsedited 20:15

Hacking Articles Tips Tricks Videos Tutorials

;o:p

In this command we have used following options:___________________________
@hacking_Attack
@Hacking_Video

4 viewsedited 20:15

Hacking Articles Tips Tricks Videos Tutorials

4 views20:38

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
IT-army of Ukraine: an appeal to Russians

submitted by /u/Aggravating-Deal-260
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

IT-army of Ukraine: an appeal to Russians

Posted in r/hacking by u/Aggravating-Deal-260 • 1 point and 1 comment

4 viewsedited 20:38

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Making a hacking game

I'm in the middle of making a hacking game and I want to make it as realistic as possible. Basically a simulation. I don't have much experience at all with hacking(i only know a couple of things) So i came here for some advice:

-What are the things that a hacking simulator must have?

-Are there any urban legends about hacking that i should avoid?

-And some general advices that would make the game better.

Ps: the game is a terminal-based game, just like hacking with linux no-gui

submitted by /u/MikeSupp
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Making a hacking game

I'm in the middle of making a hacking game and I want to make it as realistic as possible. Basically a simulation. I don't have much experience at...

3 viewsedited 20:38

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Bounty Program

Just wondering if anyone here has used or participated in a hacking bounty program? Would love to know about the good or bad of your experience. And if anyone has any idea of what the bounties could look like (in terms of value).

submitted by /u/liquefire81
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Bounty Program

Just wondering if anyone here has used or participated in a hacking bounty program? Would love to know about the good or bad of your experience....

3 viewsedited 20:38

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
I think my router was hacked, it's an old model. If I change it to a newer one will that fix the problem?

My router is very old.

I can't pay for antivirus, so I'm currently using free versions.

If I just change the router will that fix my privacy issue? Will I get back my full privacy and internet security? Or once the router is taken all my computers are infected?

submitted by /u/Green_Engineer_391
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

I think my router was hacked, it's an old model. If I change it to...

My router is very old. I can't pay for antivirus, so I'm currently using free versions. If I just change the router will that fix my privacy...

3 viewsedited 20:38

Hacking Articles Tips Tricks Videos Tutorials

3 views21:02

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking Articles
A Detailed Guide on Cewl

Hi, Pentesters! In this article, we are going to focus on the Kali Linux tool “Cewl” which will basically help you to create a wordlist. Let’s explore this tool and learn about what all other options this tool provides. Table of Contents1. Introduction to Cewl
2. Default Procedure
3. Store this wordlist in a file
4. Generating a Wordlist of a certain length
5. Retrieval of Emails from the website.
6. To count the number of words repeated on the website
7. Increase spider depth
8. Verbose Mode
9. Alphanumeric Wordlist
10. Cewl with Digest/Basic Authentication
11. Lowercase all parsed words
12. Proxy Support- Introduction to Cewl CeWL – A custom wordlist generator is a ruby program that crawls a specific URL to a defined depth and returns a list of keywords, which password crackers like John the Ripper, Medusa, and WFuzz can use to crack the passwords. Cewl also has an associated command-line app FAB, which uses the same metadata extraction techniques to generate author/producer lists from already downloaded files using information extraction algorithms like CeWL.

CeWL comes preinstalled with Kali Linux. With this tool, we can easily collect words and phrases from the target page. It is a robust program that can quickly scrape the webserver of any website.

Open the terminal of Kali Linux and type “cewl -h” to see the lists of all the options it accepts, with a complete description.

Syntax: cewl Default ProcedureUse the following command to generate a list of words that will spider the given URL to a specified depth and we can use it as a directory for cracking the passwords.
cewl http://www.vulnweb.com
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhR49UdX[...]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles

A Detailed Guide on Cewl

Discover key features of the Cewl tool in this guide. Create custom wordlists and improve your penetration testing approach.

2 viewsedited 21:02

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles A Detailed Guide on Cewl Hi, Pentesters! In this article, we are going to focus on the Kali Linux tool “Cewl” which will basically help you to create a wordlist. Let’s explore this tool and learn about what all other options this tool provides.…

tsd0Epn31YYqTZifl_Cuptv4gcIPCc_aMCncxDj1W22TrdWUZ6QHlbvPkSET9jiTxVfkkrlED03SmxA9wv3jQ1J1q7n1UAqEDw0wVExeTIj_NdoFIAsLh1NnPe9xe_L0oxwAh0eiM62fH7bzwGkkBlH4-VOYf7pMbVXdsUMDVBgRgXvTGqHjw/s16000/3.png?w=640&ssl=1 Store this wordlist in a fileNow to save this all wordlist in a file for record-keeping, efficiency and readability we will use the -w option to save the output in a text file.
cewl http://www.vulnweb.com -w dict.txt
Here dict.txt is the file name where the wordlist will be stored. Once the file has been created you can open it to see if the output is stored in the file.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5GYGWi3_iL7JfBhPX8Utf9RnHj-xlV9l8kRIbHqW7GQ0Fc5WAaOCg6TRpY8Xv8k1d0wd2PxDJLWeas64-2oRhrlnjmgWu5Y0sxZP8hIIrwaRIgzyJ4YmDvDIzpYxqvlff3GqFc6ussi_3Ido93P2hmGf2pBeF3n1PPLDnlLq74Kh82o8365y0Q3a88Q/s16000/4.png?w=640&ssl=1 Generating wordlists of a certain lengthIf you want to create a wordlist of a specific length then you can choose to use option -m and provide the minimum length for the keyword hence it will create wordlists for a certain length.
cewl http://vulnweb.com / -m 10 -w dict.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGLC2UtK7DL7LKF7BsDqI9BzDc96ETFv-M7bmB5S_hE7nNAOPfro-1oAWjl6trF1zM8LbqYv01wDeS3KF7jXz_CRoSm-mYGhhx_vLFbewHKaSE7HM2Nvf1dYIIZhNPg-KcHzIqYYnZRYg0aMg3NFbaECbGmm-PBhxPejuwqQz2sGjknbj2v50SNd8s3A/s16000/5.png?w=640&ssl=1

So basically, this will create a wordlist in which each word has a minimum of 10 letters and store these keywords in the file dict.txt. Screenshot is attached for your reference. Retrieval of Emails from the website:In order to retrieve emails from the website, we can use the -e option, while the -n option will hide the lists created while crawling the provided website. As you can see in the screenshot attached it has found 1 email-id from the website.
cewl https://digi.ninja/contact.php -e -n
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiICKDMF7jZMeWOIOWwQwCoTY6cdiL5Sa3J-f6Pk7kd3nR4BnDfZLdMA5DUimgmHJ933944BtffkuOOfAJnIvWtDnm_7Vm2CvNW5CG2wWTNBsIRYm2hYwf_2bJftQFpH6cJQknv1JFNv2hB9IyfWwKJt8PZr7nLi7k7byNJdkbiR-h4wWIp8o2mQDZ4wA/s16000/6.png?w=640&ssl=1 To count the number of words repeated on the websiteIf you want to count the number of times a word is repeated on a website, then use the -c option that will enable the count parameter.
cewl http://www.vulnweb.com -c
For your reference, a screenshot is added below which prints the count for every keyword repeated on website.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvqjUfg-iIHpXE5Xe0Y3YMRT5JmFYRn6GI4WlRXrEKddXhPn_YcAFfIHV_iBpdEWxssZo5saUyDnV7V_2BtEnsrE2MiADNvlNn7tpNRmXW0hx94rvxm3xS3K4712HV6G_F6jTkO34G6BrMm0ZA3CffWJxuXmPuQd5T9FVqtG94UqYnUqeVGMRLl3dgzw/s16000/7.png?w=640&ssl=1 Increase Spider depthYou can use -d option with the depth number to activate depth parameter for more quick and intense crawling so that a large list of words is created. The depth level is set to 2 as default.
cewl http://vulnweb.com -d 3
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjv_k2Uh7TZn4kXmoCqG6MNqh8n_grREy5cLh8s83sYXssvKlyMfByAGSrM1_BoY65OhcEq11TfSc4uUW_Fc3ibkj-ZntqwePYRNhstATFxG6GNaAA2Pd1b2ZnaVhRFh8n-L1E6OGSt_SNq2ktctYAyJCzqdPfFpzqEv4goxvmMj_18lStAPKKp5TpjxA/s16000/8.png?w=640&ssl=1 Verbose ModeWe have a -v option for the verbose mode to extend the website crawling result and retrieve complete detail of the website.
cewl http://vulnweb.com -v
So, this will display extended website crawling results. Below we have attached a screenshot so that you will get a clear idea.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1G6_WcX9R1DdOuuD-6SkjO7yxjsvnjXIvlB6BhOuRSND-NrCkx1onkKcp2tSaAokYnvin_n7Y4npNpzcw7iI8onFBGpxtJLaR1h9AAAFcQGzglcB6jyMFj0FWgicjFWTGx67YM5Nn_PLEQp5gkocp-RutGu_-P3DIIkqCCH2U67D59viFNCgiDUrYMQ/s16000/9.png?w=640&ssl=1 Alphanumeric WordlistSometimes it may happen that you may[...]

___________________________
@hacking_Attack
@Hacking_Video

2 viewsedited 21:02

Hacking Articles Tips Tricks Videos Tutorials

need an alpha-numeric wordlist that you can use –the with-numbers option to get an alpha-numeric wordlist.
cewl http://testphp.vulnweb.com/artists.php --with-numbers
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgA70MWejqDO42ptGQtPz20G1LmyAHG8se-AfYVGtJDBydeqB8R-IdH1sU7oHcgVJOUUPyjbOYGranelh7sM-GgQDll2B53662SFZSwrCFnZbDRSgXRqL75Q7UF0UW9FHUPpa0qdUepa-Ak7K0im4bS35jViHxuKWsXVow6jq5WZxreEKqygF5jeZpfow/s16000/10.png?w=640&ssl=1

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMM2RyA99wESJEydORlpN52PTw7UQ4_fjz0OzYouBmvJIBH5yosOjZ1zGqbHTOsMkLlTa-6MoNEdgcUk2cqhUjbD94ywqdON81AWUoshDtS1olrJh67vQPlmG0-_TXnLYNRIKto3rUCIHoqXkH2FD5m0d_JSq7_vRBOZIOtvl3cK8CPg09QAwV6a0VvA/s16000/11.png?w=640&ssl=1 Cewl with Digest/Basic AuthenticationIt may happen sometimes that some web applications may have an authentication page for login and for that the above basic command will not give desired results. So for that, you need to bypass the authentication page by using the command given below.
cewl http://testphp.vulnweb.com/login.php --auth_type Digest --auth_user test –auth_pass test -v
In this command we have used the following options:

–auth_type:                                                            Digest /Basic

–auth_user:                                                       Authentication Username

–auth_pass:                                                       Authentication password

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrSTDcFtoDH2CJRW9UaY3ww2ZEOFFX3gCdINlHpnqqI5GyemORwiUhOVxg_YPSUqfavMMMSdvns5_w5PmDv0dkHSi10YAL9rqz_1TSk65Pz8QB8t-ycXSdzZf1Dj7anMLJ5FUOpvct7AvJIeWClFT97QPMBXqhXUo30VRvFWTlD2GRZ3vhUEjwVbXFEg/s16000/12.png?w=640&ssl=1 Lowercase all parsed wordsWhen you need the keywords to be generated in lowercase for that you can use the –lowercase option to generate the words in lowercase.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL072NNaPeY-OVmbXG4mjieYQJ8QW2wycnOILG0taWLYslVx3NsXPOX0cU6bT_DRLdBNMQsIfigSO01KeplTfeDGuGxifTgAzLPBQVTPu5lWU2IbtGDSUb409kRnhj6b_4Ek8fjVFLz7c9G6io1LMpBOgIcLb_jHqYw_BGJA1osnY9HJcRVbKtObaE1w/s16000/14.png?w=640&ssl=1 Proxy SupportThis default command for cewl will not work properly if you have attached a proxy server. We tried to access the application through ip address but the proxy server is attached hence this gave us a Forbidden Error page.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5bL5TAzbPwGf_l6Qr8c0_hzoFyE83QuNDZNAe7GOrgsJH_HqpiqlY7tsOBia1HzfQMxQdoMrDGfjpf_2w9zY2IvVmGohC-UE0-TcPgnR0YMIBB1-Rv2yPiV58b8g-O3yoMrq14qERcfbjrJM_HRVwfgoC4hPJcGYapGTTSuqAuk_QeMsiJWz_u1xjRg/s16000/20.png?w=640&ssl=1

And here if we apply the default cewl command so it will generate the error page wordlist. Hence to get the appropriate wordlist of the web application we have used commands as:
cewl http://192.168.1.141 --proxy_host 192.168.1.141 --proxy_port 3128
In this command we have used the following options:

–proxy_host:                          Your Host

–proxy_port:                          Port number of your proxy

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgANM_ol4yywb5T2b_OqHqXyeBANZaquH0cluTNPULz_u0pjw4To7Kfx1V3-mI0sSKuKiF5-35g7CDHz6NiNFSj6xjqYEqd-mU5tTMDui0EzNBRfDAcTfLQFH0-wauHB9qTzdX_UAJ5BUS4nVYOLD358Bs4byXIN2rMIgZgjYCAOpSbmLf74F6HnjNdRg/s16000/22.png?w=640&ssl=1

Author: Divya Adwani is a researcher and technical writer who is very much keen to learn and enthusiastic to learn ethical hacking Contact here

The post A Detailed Guide on Cewl appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

2 viewsedited 21:02

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Scan This: There's Danger in QR Codes

Trendy restaurant tables now feature QR codes that lead to menus, payment apps, and CISO nightmares.

5 views21:38

Source

About

Blog

Apps

Platform