CEWL vs. Common Password Lists: Which One Is More Effective for Password Cracking?

CEWL stands for Custom Wordlist Generator, a tool used for creating custom wordlists or dictionaries that can be used for password cracking, phishing attacks, or other types of security testing. **CEWL** works by crawling a given target website or document and extracting all the unique words and phrases it finds, and then generating a custom wordlist that can be used with password cracking tools or other security testing tools to check for weak passwords or to conduct phishing attacks.

Common password lists, on the other hand, are pre-existing lists of passwords that have been compiled based on common patterns observed in previously breached or leaked passwords. These lists can include commonly used passwords like “password,” “123456,” or “qwerty,” as well as variations of these passwords with common substitutions like numbers for letters (e.g. “p@ssw0rd”) or capitalization (e.g. “Password”).

While common password lists can be helpful in identifying weak passwords, they are limited by their pre-existing nature and inability to capture unique or complex passwords. CEWL, on the other hand, is capable of generating custom wordlists that can capture unique words and phrases specific to a target and can be tailored to specific password complexity requirements. This makes CEWL a more effective tool for password cracking and security testing.

Comparing CEWL and Common Password Lists

CEWL (Custom Word List Generator) and common password lists are both tools used in password cracking, but they have different advantages and disadvantages. Here are the key points to consider:

Advantages of CEWL:

1. Customization: CEWL allows you to create wordlists based on specific websites or documents related to the target, which can increase the chances of finding relevant passwords.
2. Targeted approach: By generating wordlists based on the target’s content, you can focus on the specific words, phrases, or jargon that may be used in passwords.
3. Contextual relevance: CEWL can capture words specific to the target, such as employee names, product names, or project codes, which may be more likely to be used as passwords within that context.

Disadvantages of CEWL:

1. Limited scope: CEWL relies on the content available on a specific website or document. If the target information is limited or the scope is narrow, the resulting wordlist may not be comprehensive enough to cover all possible passwords.
2. Time-consuming: Generating a custom wordlist with CEWL can be time-consuming, especially if you need to analyze a large website or document with extensive content.
3. False positives: CEWL may include words or phrases that are not actually used as passwords, leading to false positives and wasting computational resources.

Advantages of common password lists:

1. Wide coverage: Common password lists contain a wide range of commonly used passwords, including dictionary words, popular phrases, and common patterns. They cover a broad spectrum of potential passwords, increasing the likelihood of finding a match.
2. Efficiency: Since common password lists are readily available, you can quickly load them into password cracking tools and start the process without spending time on customization or generation.
3. Inclusion of known weak passwords: Common password lists often include known weak passwords, such as “password123” or “123456,” which are frequently used by individuals with poor password security practices.

Disadvantages of common password lists:

1. Lack of customization: Common password lists are generic and not tailored to the specific target or context, which means they may not include passwords relevant to the target.
2. Susceptible to password security improvements: As security awareness increases and password policies become more stringent, common password lists may become less effective at cracking passwords.
3. High chance of failure against strong passwords: Common password lists are unlikely to crack passwords that are complex, long, or randomly generated, as they are designed to target weak or commonly used passwords.

V. Case Study: Comparing CEWL and Common Password Lists

• Demonstration of how CEWL and common password lists can be used to crack passwords

Installation

Install the last stable release from Cewl:

sudo apt-get install cewl

cewl -v

Basic Usage:

cew [URL] -w [OUTPUT]

Options:

• -w : indicate the output file.
• -c : enable the count parameter to count the number of terms repeated several times in a website.
• -d : the depth level number to activate the depth parameter for more quick crawling if you want to raise the spider level to create a larger list of words by counting more new words from the page. This depth level is set to 2 by default.
• --debug : activate debug mode and view issues and raw website information while crawling.
• -m : minimum word length.

Use the -d option with the depth level number to activate the depth parameter for more quick crawling if you want to raise the spider level to create a larger list of words by counting more new words from the page. This depth level is set to 2 by default.

cewl https://www.google.com -w output/google.out

Conclusion

CEWL (Custom Word List Generator) allows for customized wordlist creation based on specific websites or documents, increasing the chances of finding relevant passwords. Common password lists offer wide coverage of commonly used passwords but lack customization. CEWL is time-consuming and may have false positives, while common password lists are efficient but less effective against strong passwords. The choice depends on customization needs and the target’s password complexity. Adhering to ethical guidelines is crucial in password cracking activities.