The Custom Word List (CeWL) (http://www.digininja.org/projects/cewl.php) generator is a tool that will spider a target Uniform Resource Locator (URL) and create a unique list of the words found on that URL. This list can then be used by password-cracking tools such as John the Ripper.

The following are several useful options in CeWL:

• depth N or -d N: This sets the spider depth to N; the default value is 2
• min_word_length N or -m N: This is the minimum word length; the default length is 3
• verbose or -v: This gives a verbose output
• write or -w: This is to write output to a file

If you get a problem running CeWL in Kali with an error message, Error: zip/zip gem not installed, use gem install zip/zip to install the required gem. To fix this problem, just follow the suggestions to install zip gem:

    gem install zip
    Fetching: zip-2.0.2.gem (100%)
    Successfully installed zip-2.0.2
    1 gem installed
    Installing ri documentation for zip-2.0.2...
    Installing RDoc documentation for zip-2.0.2...
  

Let's try to create a custom wordlist from a target website. In this case, we will use the built-in website in Metasploitable. To create the wordlist, the following is the cewl command to be used:

    cewl -w metasploitable.txt http://172.16.43.156/mutillidae

After some time, the result will be created. In Kali, the output is stored in the root directory.

The following is the abridged content of the target.txt file:

the 
Injection 
var 
and 
Storage 
Site 
Data 
User 
Log 
Info 
blog 
File 
HTML5 
Login 
Viewer

Lookup 
securityLevelDescription 
Mutillidae