DevDigest

,

How to Use CeWL for Ethical Password Guessing from Public Info

Password guessing doesn’t start with brute force—it starts with your old blog. Use CeWL to ethically test what personal info could expose your credentials.

Tags: , , , , , , , , , ,
A Filipina woman in glasses using her laptop on a rooftop in Makati at dusk, with the city skyline glowing softly in the background. Pin It!
High above the city, Calista searches the open web—quietly exposing the password patterns hidden in plain sight.

Password guessing doesn’t start with brute force—it starts with your old blog.

The Forgotten Blog That Could’ve Wrecked a Business

A friend of mine — Elle, who runs a scrappy but thriving virtual assistant agency — messaged me in a panic one evening.

“We keep getting login alerts from Nigeria, Vietnam, all over,” she said. “Slack, Zoom, Facebook. If we didn’t have 2FA, we’d be toast.”

As someone who’s spent the better part of a decade building secure, ethical, and open-source-first systems, this wasn’t just another help-desk favor. It was a field test.

I traced the breach attempt to something all too familiar: a forgotten Tumblr blog still packed with birthday posts, pet names, and her old street address. Not passwords, but password ingredients — the kind that make password guessing attacks painfully easy.

Using a simple but powerful FOSS tool called CeWL, I scraped the blog and generated a custom wordlist. The results were… disturbingly on point.

If you run an NGO, a one-person operation, or any online-facing advocacy, and you still reuse passwords or use personal details, this story is your wake-up call.

Read on to learn how attackers build password guessing wordlists using tools like CeWL — and how to protect yourself.

Table of Contents

Pin It!
Pin It!
Pin It!

The Forgotten Blog: A Goldmine for Guessable Passwords

Her current systems? Locked down.

But a reverse search of an old username revealed something she’d long forgotten:
a public Tumblr blog from her early freelancing days.

Inside:

  • Her dog’s name — “Fluffy turned 4 today!”
  • Birthday wishes
  • Email addresses
  • Favorite bands
  • Even her street name in a “Day in My Life” post

No passwords — but tons of personal info commonly used in guessable passwords.

· · ─ ·𖥸· ─ · ·

CeWL: A Custom Wordlist Generator for Smarter Password Guessing

This is where CeWL (Custom Word List generator) shines.

Instead of throwing massive generic lists at a login form, CeWL lets you generate a targeted wordlist based on actual, real-world content — like a blog post, social media profile, or about page.

For anyone exploring password guessing techniques ethically, CeWL is a must-have.

Installing CeWL for Password Guessing and Recon

Before we dive into scraping old content for password clues, you’ll need to install CeWL, a lightweight yet powerful tool built in Ruby that generates custom wordlists from URLs. Whether you’re on Termux, Kali Linux, or a privacy-respecting distro like Parrot OS, CeWL is easy to set up — and essential for any FOSS-flavored recon stack.

This primer covers prerequisites and platform-specific notes to help you avoid common snags. Scroll down when you’re ready to start scraping.

In Termux:

pkg update && pkg upgrade
pkg install ruby git
gem install cewl

In Kali Linux:

sudo apt update
sudo apt install cewl

· · ─ ·𖥸· ─ · ·

CeWL for Password Guessing: Targeting a Single Page

To generate a wordlist from a single page (like Elle’s blog homepage):

cewl https://example.tumblr.com -d 0 -w wordlist.txt

Key flags:

  • -d 0 → don’t follow links (crawl depth 0)
  • -w wordlist.txt → write output to file

Want live feedback?

cewl https://example.tumblr.com -d 0 -v

Use -m 5 to exclude super short or common words:

cewl https://example.tumblr.com -d 0 -m 5 -w wordlist.txt

· · ─ ·𖥸· ─ · ·

How CeWL Supports Real-World Password Guessing

The CeWL-generated wordlist from Elle’s forgotten blog included:

  • fluffy2017
  • greenhills88
  • elleparamore
  • sunsetAve2012

It’s not that these were her current passwords — but they could have been.
That’s the danger of predictable, personal info in password guessing scenarios.

· · ─ ·𖥸· ─ · ·

Using CeWL Wordlists with Hashcat or John the Ripper

So you’ve scraped a blog, grabbed a bunch of words — now what?

Here’s how to plug your CeWL output into password guessing tools like Hashcat or John the Ripper to ethically test system resilience.

Step 1: Clean and Format Your Wordlist

CeWL outputs a clean .txt list by default, but you might want to preprocess it:

sort cewl_words.txt | uniq > wordlist.txt

This removes duplicates and sorts your wordlist — useful for improving performance in cracking tools.

Step 2: Use It with Hashcat

Let’s say you have a password hash in MD5 format (for educational purposes only):

hashcat -m 0 -a 0 -o cracked.txt hashes.txt wordlist.txt
  • -m 0 tells Hashcat the hash type (MD5)
  • -a 0 is a straight wordlist attack
  • hashes.txt contains one hash per line
  • wordlist.txt is your CeWL-crafted file

Step 3: Interpret Results

If any hashes crack, study the output. What patterns do they follow? Were they built from personal info, favorite bands, birthdates?

This reinforces the lesson: passwords built from public details are barely passwords at all.

Want to take it further? Pipe CeWL output into tools like rsmangler, cuppy, or custom Python scripts to add permutations — a great exercise for beginners exploring OSINT, scripting, and cybersec fundamentals.

· · ─ ·𖥸· ─ · ·

Common Patterns Attackers Try

Here are real-world password guessing formats derived from scraped personal info:

Name + Numbers

  • john1990
  • smith77
  • mike2015

Initials + Birthdate

  • jd1985
  • asm0101
  • klm1212

Name + Special Character + Numbers

  • emma!23
  • daniel_88
  • sara#2020

Pet Names

  • fluffy123
  • daisy2021

City or Place + Numbers

  • london1999
  • tokyo_123

Sports Team + Number

  • lakers23
  • manu1999

Simple Keyboard + Info

  • abc123john
  • qwerty1985
  • passwordmike

Birthdate Formats

  • 19900101
  • 01011990
  • 90john85

· · ─ ·𖥸· ─ · ·

What’s a Wordlist, and Why Build Your Own?

Most password guessing attacks don’t start with brute force. They start with guesswork, based on what people share online — names, birthdays, pet names, favorite bands.

A wordlist is just a text file, one word per line. Tools like Hashcat or John the Ripper use it to try each entry as a potential password.

Public wordlists like rockyou.txt are widely used — but they’re noisy and generic. A custom wordlist scraped from a person’s old blog or profile with CeWL is laser-targeted. That’s what makes it effective — and dangerous.

Building your own helps you understand how real-world attacks work so you can defend against them.

· · ─ ·𖥸· ─ · ·

How CeWL Works Behind the Scenes (FOSS-style)

CeWL isn’t just a crawler — it’s a selective harvester. Written in Ruby, it loads a given webpage, strips out HTML, extracts visible text, and compiles a list of words based on:

  • Minimum word length (default is 3)
  • Frequency count (so you can see which words show up the most)
  • Depth of crawl (-d option) — how many links away from the original page you want to explore

It can also grab metadata (like author names or descriptions), authenticate through login pages, and even export to formats readable by cracking tools.

Since it’s open source, you can dig into the Ruby code or tweak it for your own projects — a huge plus for students and tinkerers learning ethical hacking the right way.

· · ─ ·𖥸· ─ · ·

Where to Use CeWL (Ethically): Real-World, FOSS-Aligned Scenarios

CeWL isn’t just for red teamers or cybersecurity pros — it’s an excellent tool for teaching, advocacy, and community defense. Here are a few practical, FOSS-aligned scenarios where CeWL shines:

  • Pentesting for NGOs or small businesses
    Many underfunded organizations lack the resources to harden their systems. CeWL allows volunteer pentesters or internal IT leads to simulate real attacks using the organization’s own public content — helping to identify weak password habits without intrusive scans.
  • Educational CTFs (Capture the Flag)
    CeWL is beginner-friendly and scriptable, making it ideal for ethical hacking competitions in schools or community tech events. Students learn the importance of operational security by building and using wordlists from mock sites.
  • Digital forensics and password recovery
    Investigators or sysadmins helping a colleague recover access to old systems can scrape personal blogs or forgotten bios to reconstruct likely passwords — all without brute-force cracking.
  • Online safety workshops for activists
    Trainers can demonstrate how quickly a stranger can assemble a password list using public posts — a powerful way to teach digital hygiene in marginalized or at-risk communities.

By sticking to informed consent, transparency, and open-source tooling, CeWL can be a force for good — not just a hacker toy.

· · ─ ·𖥸· ─ · ·

Protect Yourself from Password Guessing Before It Happens

Password guessing isn’t about brute force anymore — it’s about targeted intelligence. Tools like CeWL automate the process of turning forgotten content into attack vectors. If your dog’s name, birth year, or email still appear on some dusty blog or forum, chances are, it’s already in someone’s wordlist.

In Elle’s case, 2FA saved her. But not everyone’s that lucky.

✅ Audit your old online content
✅ Stop using guessable personal info in passwords
✅ Use tools like CeWL to test your own exposure

If you believe in digital sovereignty, FOSS, and personal resilience in tech, now’s the time to act.

👉 Subscribe to the DevDigest newsletter — get field-tested tools, practical guides, and privacy-first strategies you can use immediately:
https://www.samgalope.dev/newsletter/

Leave a Reply

Your email address will not be published. Required fields are marked *

Comments (

)