Personal compilation of wordlists & dictionaries for everything. Users, passwords, directories, files, vulnerabilities, fuzzing, injections, etc. In a peculiar order, sorry.
If you want to add more or If you know the authorship of a dictionary, contact me.
- PayloadsAllTheThings
- A list of useful payloads and bypass for Web Application Security and Pentest/CTF (CSRF, LDAP, NoSQL, XEE, etc.).
- Cross-Site Scripting (XSS)
- SQL
- Path Trasversal
- Vendor Default
- Tomcat
- Oracle
- ckeditor 4.7.3 (by @_devalias)
- GovCMS 7.x-2.15 (by @_devalias)
- ASP
- JSP
- PHP 1/2
- PHP 2/2
- Exploitable PHP functions
- Mix Subdomains popular 2020 (incoming...)
- Mix Subdomains popular 2017
- Mix Subdomains popular 2016
- Certificate Transparency Subdomains
- Naughty Strings
- Google 10000 English
- This repo contains a list of the 10,000 most common English words in order of frequency, as determined by n-gram frequency analysis of the Google's Trillion Word Corpus.
- SQLmap
- sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.
- Hashcat
- World's fastest and most advanced password recovery utility.
- Dirb
- DIRB is a Web Content Scanner. It looks for existing (and/or hidden) Web Objects. It basically works by launching a dictionary based attack against a web server and analyzing the response.
- Fuzzdb
- Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
- DirSearch
- Web path scanner.
- Wfuzz
- Web application fuzzer http://wfuzz.io.
- Cfuzzer
- url-fuzzer.
- Pyfuzz
- URL fuzzing tool made of Python.
- CommonSpeak
- Commonspeak is a wordlist generation tool that leverages public datasets from Google's BigQuery platform.
Do you want more info? In my personal blog there are some more :
- Device search engines. ๐
- Links to resources. ๐
- 1024MEGAS.com. ๐จโ๐ป
Collected by @Dormidera.