cewl(1)

✨ cewl — custom word list generator ✨

okay bestie, gather round, because this is the little ruby bestie that turns a whole website into a wordlist 💖 it's called cewl, it lives in section 1 of the manual, and it is genuinely one of the most useful glow-ups in the whole pentesting group chat.

---

🌈 SYNOPSIS 🌈

cewl [OPTION] ... URL

that's it. that's the whole vibe. drop your options, drop your URL, get words. 💅

---

🦋 DESCRIPTION 🦋

CeWL (aka Custom Word List generator, no cap) is a ruby app that goes and spiders a given URL — crawling down to a depth you specify — and hands you back a list of words. and what do you do with those words? you feed them to password crackers like John the Ripper, obviously. it's giving recon era. 👑

and yes, optionally, CeWL can follow external links too. it's nosy like that and we love her for it.

CeWL can also build you a list of email addresses scraped from mailto links. those emails? perfect as usernames in brute force actions. two for one, ate. 🍓

oh and pronunciation check, because everyone gets this wrong: CeWL is pronounced "cool". because she is. periodt. 😎

---

✨ OPTIONS ✨

💜 General options

• -h, --help — show help. the "hello, what do u do" button.
• -k, --keep — keep the downloaded file. don't ghost the evidence.
• -d <x>, --depth <x> — how deep to spider. default is 2.
• -m, --min_word_length — minimum word length. default is 3.
• -o, --offsite — let the spider go visit other sites. she's traveling now ✈️
• --exclude — a file containing a list of paths to exclude. like a block list but for paths.
• --allowed — a regex pattern that a path must match in order to be followed.
• -w, --write — write the output to the file.
• -u, --ua <agent> — the user agent to send.
• -n, --no-words — don't output the wordlist. (yes it still does its thing, it's just not telling you about the words.)
• -g <x>, --groups <x> — return groups of words as well.
• --lowercase — lowercase all parsed words. everyone gets the same energy.
• --with-numbers — accept words with numbers in them as well as just letters.
• --convert-umlauts — convert common ISO-8859-1 (Latin-1) umlauts: ä-ae, ö-oe, ü-ue, ß-ss.
• -a, --meta — include meta data.
• --meta_file file — output file for meta data.
• -e, --email — include email addresses.
• --email_file <file> — output file for email addresses.
• --meta-temp-dir <dir> — the temporary directory used by exiftool when parsing files. default is /tmp.
• -c, --count — show the count for each word found. numbers on numbers 🔥
• -v, --verbose — verbose. she tells you everything.
• --debug — extra debug information.

🔐 Authentication

• --auth_type — digest or basic.
• --auth_user — authentication username.
• --auth_pass — authentication password.

🧚 Proxy Support

• --proxy_host — proxy host.
• --proxy_port — proxy port. default is 8080.
• --proxy_username — username for proxy, if required.
• --proxy_password — password for proxy, if required.

🎀 Headers

• --header, -H — in format name:value — can pass multiple.

🫶 The URL

• <url> — the site to spider. this is the whole point bestie.

---

💡 TIP 💡

sometimes CeWL will return nothing. like, zero words, empty vibe, ghosted. if that happens, use the -v option to see the issue causing no output.

for example: if $ cewl http://example.org gets redirected to https://example.org, cewl will keep a silent. 😭 rude of it, honestly. but now you know.

---

💀 BUGS 💀

someone has reported that the spider misses some pages which are have querystrings on them. this issue isn't confirmed. so like… allegedly. 🙈

---

👀 SEE ALSO 👀

• fab-cewl(1)

---

🌸 AUTHOR 🌸

the CeWL was written by Robin Wood <robin@digi.ninja>.

this manual page was written by Joao Eriberto Mota Filho <eriberto@debian.org> for the Debian project (but may be used by others). absolute icon behavior, iykyk. 👑

---

okay and that's the whole page bestie, ily, go scrape something 🦋

this was cewl-6.0, dated 26 Jul 2023, and it's page cewl(1) of the manual. mwah 💖✨🎀