Which Tool Does Hailey Use to Harvest Words from the Target Website for Brute-Force?
In an attempt to damage the reputation of a competitor organization, Hailey, a professional hacker, gathers a list of employee and client email addresses and other related information by using various search engines, social networking sites, and web spidering tools. In this process, she also uses an automated tool to gather a list of words from the target website to further perform a brute-force attack on the previously gathered email addresses. What is the tool used by Hailey for gathering a list of words from the target website?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests recognition of wordlist-generation tooling used in footprinting before a brute-force attack, and the trap is confusing it with anonymity/circumvention tools that never touch the target's content.
CeWL (Custom Word List generator) is the reconnaissance tool that spiders a target website and builds a custom wordlist from the words it finds. This page confirms CeWL as the tool Hailey uses and explains why the three proxy/anonymity tools in the other options cannot perform word harvesting.
Learners sometimes pick Psiphon, Orbot or Shadowsocks because those names look like 'hacking tools', but all three are traffic-tunnelling/anonymity clients and produce no wordlist at all.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
CeWL (Custom Word List generator) is a Ruby-based tool that spiders a target website to a chosen depth and extracts unique words from the pages it crawls, including metadata such as author names and email addresses. It then writes those words to a text file that can be fed directly into brute-force tools like Hydra, Medusa or Burp Intruder. The scenario describes exactly that workflow: Hailey first harvests employee and client email addresses through search engines, social networking sites and web spidering, then runs an automated tool to build a word list from the target website so the passwords or account identifiers can be guessed. Community consensus matches the source key, with shaody noting that "An attacker can use the CeWL tool to gather a list of words from the target website" and insaniunt simply recording "A. CeWL", while LordXander anchors it to the CEHv12 blueprint area.Why the Other Options Are Wrong
Orbot is an Android Tor proxy client that routes an app's traffic through the Tor network; it is a circumvention/anonymity tool with no crawling or word-extraction capability. Shadowsocks is an encrypted SOCKS5 proxy designed to bypass network censorship, again purely a tunnelling utility. Psiphon is a similar censorship-circumvention client that tunnels traffic through remote servers. None of the three parses web pages, extracts words, or outputs a wordlist file — they would be used to hide Hailey's origin during the attack, not to build the brute-force dictionary the question asks about. Only CeWL performs the described content harvesting from the target site.Community Comment Notes
Every recorded vote on this question selects CeWL, and the comments are consistent with that: shaody's explanation focuses on CeWL's role in word-list gathering, insaniunt and sunce12 both post plain "A. CeWL" confirmations, and LordXander's terse "CEHv12 - 202" points to the official courseware page covering the tool. There is no dissenting comment arguing for a proxy tool, so the community record gives no reason to depart from the source key here; the technical analysis of the options independently reaches the same conclusion.Official Reference
Exam Strategy
Map each option to its functional category before answering: crawler/wordlist generators, proxies/anonymisers, and scanners each appear in different CEH modules. If the stem mentions 'gathering words from the target website', the answer is always the custom wordlist generator.
Frequently Asked Questions
Why is Shadowsocks wrong if Hailey wants to stay anonymous while harvesting emails?
Shadowsocks is only an encrypted SOCKS5 proxy for evading censorship; it never crawls a site or outputs a wordlist, so it cannot satisfy the tool requirement in the stem.
What exactly does CeWL extract from the target website?
CeWL spiders pages to a chosen depth and collects unique words, plus optional metadata such as author names and email addresses, saving them to a text file for tools like Hydra.