Customizing password lists is one of the best ways to increase the chances of finding valid credentials. We can create custom password lists from the target website. Often, a company's website contains valuable information about the company and its employees, including emails and employee names. In addition, the website may contain keywords specific to what the company offers, including product and service names, which may be used in an employee's password!
Tools such as Cewl can be used to effectively crawl a website and extract strings or keywords. Cewl is a powerful tool to generate a wordlist specific to a given company or target. Consider the following example below:
cewl -w list.txt -d 5 -m 5 <http://domain.coom>
-w will write the contents to a file. In this case, list.txt.-m 5 gathers strings (words) that are 5 characters or more-d 5 is the depth level of web crawling/spidering (default 2)As a result, we should now have a decently sized wordlist based on relevant words for the specific enterprise, like names, locations, and a lot of their business lingo. Similarly, the wordlist that was created could be used to fuzz for usernames.
Gathering employees' names in the enumeration stage is essential. We can generate username lists from the target's website. For the following example, we'll assume we have a {first name} {last name} (ex: John Smith) and a method of generating usernames.
Thankfully, there is a tool username_generator that could help create a list with most of the possible combinations if we have a first name and last name.
[username-generate.py](https://rohitguntuku.notion.site/username-generate-py-39b916733bfa4e3a8c5fbe5d538ce8e6)