Gathering information for custom wordlists

CeWL: Words and emails

cewl -d [number] -m [number] --lowercase --with-numbers -e --email_file [file] -w [file] http://[MACHINE_IP]

Flag	Description
-d [number]	Spider [number] levels deep
-m [number]	Only include words with [number] or more characters
--lowercase	Convert all extracted words to lowercase
--with-numbers	Include words that contain numbers
-e	Enable email extraction
--email_file [file]	Save found emails
-w [file]	Save extracted words

Download documents

wget -r -A pdf http://[MACHINE_IP]/[folder]/

Extract strings

Extract strings from the above downloaded docs
for f in $(find [folder_with_files] -name '*.pdf'); do strings -n 5 "$f" | grep -vP '^[/<>%0-9\\]|^(stream|endstream|endobj|xref|trailer|startxref)$' >> raw_words.txt; done

Extract Emails from pdfs

Extract emails from above downloaded docs
grep -RhiaoP '[A-Za-z0-9._%+-]+@[domain]\.com' [folder_with_files] > emails_docs.txt
sort -u emails_docs.txt > emails_docs.unique.txt
grep -Po '^[^@]+' emails_docs.unique.txt > users_from_emails.txt

Gathering more users

• Look at the page
• Try to extract from the HTML using grep
• When you have a file with first and last names:
first.last:
awk '{print tolower($1)"."tolower($2)}' names.txt > users_first.last.txt
first initial + last:
awk '{print tolower(substr($1,1,1))tolower($2)}' names.txt > users_flast.txt
first + last initial:
awk '{print tolower($1)tolower(substr($2,1,1))}' names.txt > users_firstl.txt

Generating passwords for a user

git clone https://github.com/Mebus/cupp.git && cd cupp
./cupp -i
Interactive mode, answer the questions