bo0om / fuzz.txt

Potentially dangerous files

fuzz.txt

There's Nothing so Permanent as Temporary

Any ideas?

fuzz.txt's Issues

[Improvement] Some new checks

.circleci/.firebase.secrets.json.enc
.circleci/.firebase.secrets.json

Add /debug/routes and /routes

Если загуглить как посмотреть все роуты ASP.NET, много рекомендаций в первой выдаче - создать новый роут /debug/routes или /routes, который их будет перечислять. Возможно, такие же "рекомендации" есть и для других фреймворков.

https://www.meziantou.net/list-all-routes-in-an-asp-net-core-application.htm
https://stackoverflow.com/questions/41908957/get-all-registered-routes-in-asp-net-core

Добавить:

debug/routes
routes

Two entries were detected by akamai

This was reported in danielmiessler/SecLists#943

Two entries in the list was caught by akamai waf

remote/fgt_lang?lang=/../../../../////////////////////////bin/sslvpnd
remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession

This is meant to be an informative notice so no immediate actions need to be taken.

Add phpbb

How about adding /phpbb path?

I think this word should be added

I think this word should be added
vtigercrm

.dmp and .sav

.dmp and .sav

.dmp is sometimes generated by windows unattended upgrade/migration scripts/tools

.sav commom for doze nimdas to name their +1 old backup of registry hives

.sys while you're at it.. pagefile(s)
.out

Add checks for Spring Boot Actuator

Consider adding checks for Spring Boot Actuator, which if openly accessible in production can be leveraged to run trace, dump memory, manipulate environment variables, etc. [1][2][3]

/actuator
/actuator/auditevents
/actuator/autoconfig
/actuator/beans
/actuator/caches
/actuator/conditions
/actuator/configprops
/actuator/env
/actuator/flyway
/actuator/health
/actuator/httptrace
/actuator/info
/actuator/integrationgraph
/actuator/loggers
/actuator/liquibase
/actuator/metrics
/actuator/mappings
/actuator/scheduledtasks
/actuator/sessions
/actuator/shutdown
/actuator/threaddump
/actuator/heapdump
/actuator/jolokia
/actuator/logfile
/actuator/prometheus

.bak

.bak

g

g

Add security.txt

I think if there are robots.txt in you wordlist, it would be nice to add security.txt file:
.well-known/security.txt

script to run it?

script to run it?

images

Any image file could be dangerous; people will click on to open.

PDFs are in themselves dangerous, esp if they execute scripts inside.

validation-key.txt

N

Suggest removing logout

Not sure if you want a PR for this, but I suggest removing potential logout URLs. They are a lot more problematic than useful in my opinion, and don't fit this targeted list well.

logout
logout.asp
logout/

Add fuzz.txt

Add fuzz.txt to the list. How is it dangerous? SkriptKiddies could use this to find out how the listed files are dangerous, and use them.