CeWL — Install, Use, Optimise (2026)

Custom wordlist generator that crawls a target site and extracts unique words — perfect for context-aware password cracking.

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

Linux (apt)

sudo apt install cewl

Source

git clone https://github.com/digininja/CeWL && cd CeWL && bundle install

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

Crawl site, output wordlist

cewl https://target.com -w wordlist.txt

Min word length 6, depth 3

cewl https://target.com -m 6 -d 3 -w wordlist.txt

Include digits in words

cewl https://target.com --with-numbers -w wordlist.txt

Crawl AND extract emails

cewl https://target.com -e -w words.txt

PDF / DOC content too

cewl https://target.com --meta -w words.txt --meta_file meta.txt

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• -d 3 default depth. Bump to 5 for thorough crawl, drop to 1 for quick top-level.
• --ua "Mozilla..." custom UA — many sites block default Ruby UA.
• -m 6 minimum word length — shorter generates noise.
• Pair with rsmangler to permute results: leetspeak, capitalisation, year suffixes.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• Crawls only HTML by default. PDF/DOCX content needs --meta + extra plugins.
• Some sites block Ruby HTTP libraries. Set --ua.
• Speed: crawls one URL at a time. Big sites = hours.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• katana (ProjectDiscovery) — modern crawler; pipe through tr for word extraction.
• BBHM (in Burp) — passive word extraction from proxy traffic.

India context and engagement notes

Indian-context password cracking: CeWL the company website + LinkedIn profile + product names. Combine with rsmangler — finds RingSafe@2026, Manish123, cybersec!-style passwords that no generic wordlist contains.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.