GitHub
github.com › gmelodie › awesome-wordlists
GitHub - gmelodie/awesome-wordlists: A curated list of wordlists for bruteforcing and fuzzing · GitHub
n0kovo_subdomains - An extremely effective subdomain wordlist of 3,000,000 lines, crafted by harvesting SSL certs from the entire IPv4 space. api_wordlist - API endpoints and routes wordlist for API discovery.
GitHub
github.com › chrislockard › api_wordlist
GitHub - chrislockard/api_wordlist: A wordlist of API names for web application assessments · GitHub
A wordlist of API names used for fuzzing web application APIs.
security - Can you brute force discover REST API endpoints? - Stack Overflow
If I have a rest endpoint for logging in that doesn't match common semantics, like a random UID my_url.com/api/2lk3jh54kjhlkj34hhlkjhvaksjdv123 and similar parameter names, does that make it rela... More on stackoverflow.com
Best OSCP wordlists
In my experience rockyou.txt is the standard for brute forcing passwords. common.tx in /usr/share/dirb/wordlists/ or /usr/share/seclists/Discovery/Webapps/ is a good small file (4000+) wordlist for directories, and the 2.3-medium list is a good larger list. Subdomain lists in /usr/share/seclists/Discovery/DNS/ are good, there is a top 5000, 20000, and 50000(?) list I believe. There are also decent name lists in seclists as well. More on reddit.com
18
21
February 13, 2024What is the best wordlist?
No real "best". Depends what you're doing. Github/SecLists is a good start, and weakpasswords.net . Rockyou.txt is a bit old (i heard a newer version came out but i almost never had luck with the list). More on reddit.com
24
8
February 3, 2025Subdomain enumeration
If you just want to find Subdomains, there are ready made tools for that like Sublist3r . But if you want to build your own tool to learn, that is also good. (Sublist3r will always be better, because it leverages search engines). If you are dealing with internal networks, where a searchengine has no insight, then other tools like you mentioned are necessary. Resolving Vs bruteforce: well resolving is sending a request and getting a response while bruteforceing is sending many requests to see which are successful. To find Subdomains you are not aware about, you need to try to "resolve" many feasible names, to see which are successful, this is called bruteforceing. 404 is an http status code and has nothing to do with DNS. The common DNS status responses are: NOERROR, NXDOMAIN, SERVFAIL, and REFUSE. Does the tool massdns take a long time to produce its own output, or do you get the output quickly, but struggle to get the interesting parts out of it? More on reddit.com
11
2
November 9, 2024X
x.com › payloadartist › status › 1240591694753452032
payloadartist (@payloadartist) on X
March 19, 2020 - Some awesome wordlists for fuzzing and dir bruteforce: (By @nullenc0de) gist.github.com/nullenc0de/9cb… gist.github.com/nullenc0de/96f… (By @Jhaddix) gist.github.com/jhaddix/f64c97… gist.github.com/jhaddix/b80ea6…
Sanjaymenon
sanjaymenon.xyz › blog › api wordlists
API Wordlists | Sanjaymenon
December 29, 2022 - API hacking wordlists are collections of words and phrases used to perform brute force and dictionary-based attacks on APIs to identify vulnerabilities
Escape Tech
escape.tech › blog › graphql › graphql wordlist: free open source for penetration testing
GraphQL Wordlist: Free Open Source for Penetration Testing
June 11, 2026 - We built a free open source GraphQL wordlist for penetration testing from 60k+ schemas. Boost your security testing with smarter brute-force tools.
Medium
iaraoz.medium.com › hacking-apis-exploiting-shadow-apis-and-forgotten-endpoints-9930c78e7c2d
Hacking APIs: Exploiting Shadow APIs and Forgotten Endpoints | by Israel Aráoz Severiche | Medium
October 21, 2025 - Attackers use tools like ffuf, dirsearch, or httpx to brute-force API paths. Example command: ffuf -w wordlist.txt -u… · 616 followers · ·34 following · {💀Cybersecurity Engineer🐞 } / { 🥋 Brown Belt Brazilian Jiu Jitsu } / {🌐https://twitter.com/iara0z} Help ·
GitHub
github.com › z5jt › API-documentation-Wordlist
GitHub - z5jt/API-documentation-Wordlist: A wordlist of API documentation endpoint used for fuzzing web application APIs. · GitHub
API-Documentation-Wordlist: Contains wordlists for common API documentation endpoints that are widely applicable. Brute Force After Your API Route Endpoint Use the wordlist to fuzz endpoints after your base API route.
Gitbook
gowthams.gitbook.io › bughunter-handbook › fuzzing-wordlists
Fuzzing / Wordlists | Bug Hunter Handbook - GitBook
December 24, 2021 - Dirbuster - When you're brute forcing for endpoints, don't forget to add extensions. You can also use this method to discover backup files.
Pentest-book
pentest-book.com › enumeration › webservices › apis
APIs | Pentest Book
January 27, 2025 - # Tools https://github.com/Fuzzapi/fuzzapi https://github.com/Fuzzapi/API-fuzzer https://github.com/flipkart-incubator/Astra https://github.com/BBVA/apicheck/ https://github.com/ngalongc/openapi_security_scanner https://github.com/assetnote/kiterunner https://github.com/s0md3v/dump/tree/master/json2paths https://github.com/API-Security/APIKit # API keys guesser https://api-guesser.netlify.app/ # Wordlists https://github.com/chrislockard/api_wordlist https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/common-api-endpoints-mazen160.txt https://github.com/danielmiessler/S
Packt SecPro
security.packt.com › home › how to use kite runner for api enumeration
How to use Kite runner for API Enumeration - Packt SecPro
September 30, 2022 - By collating a dataset of Swagger specifications and condensing it into our own schema, Kiterunner can use this dataset to Bruteforce API endpoints by sending the correct HTTP method, headers, path, parameters, and values for each request it sends.” · You can download a pre-built copy from https://github.com/assetnote/kiterunner/releases or you can clone the Git Repo and build from the source. The kite runner has extensive and multiple options to scan domains and API endpoints with help of wordlists.
Medium
aimasterprompt.medium.com › collection-of-wordlists-for-bug-bounty-hunters-a07c0dee92ff
Collection of Wordlists for Bug Bounty Hunters | by aimaster | Medium
February 2, 2025 - A wordlist is a collection of common words, URLs, subdomains, passwords, and payloads used to brute-force or fuzz various security parameters.
GitHub
github.com › random-robbie › bruteforce-lists › blob › master › api.txt
bruteforce-lists/api.txt at master · random-robbie/bruteforce-lists
/v1/api/token/ /v1/app/force/update · /v1/app/main/update/check · /v1/appliance/area/setup · /v1/appliance/country/channel/retrieve · /v1/appliance/info/bind/get · /v1/appliance/info/modify · /v1/appliance/protocol/lua/luaGet · /v1/appliance/protocol/lua/luaGetCbc ·
Author: random-robbie
Pentest-Tools
pentest-tools.com › home › features › wordlists
Tried, tested, customizable wordlists - Pentest-Tools.com
Field-tested, noise-free wordlists for password audits, subdomain discovery, directory fuzzing & API mapping. Ready-to-use, customizable via REST API.
Medium
coffsec.medium.com › 10-recon-wordlists-every-pentester-must-know-484499d2ce9c
10 Recon Wordlists Every Pentester Must Know | by COFFSec | Medium
March 27, 2026 - When to use: Post-exploitation hash cracking when standard lists fail. Run on a GPU-equipped machine. Not suitable for online brute force due to size. ... When you need one wordlist to cover everything — directories, files, API paths, backup files, common extensions — OneListForAll is built for exactly that scenario.
Gitbook
hackerlab.gitbook.io › wiki.hackerlab.cz › web-pentesting › enumeration-with-wordlists
Enumeration with Wordlists - wiki.hackerlab.cz - GitBook
August 16, 2024 - gobuster dir --url https://a/api --wordlist /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-small.txt -k -r -b 500,404 -t 1 --timeout 25s --exclude-length 47340 --proxy http://127.0.0.1:8080 -o gobuster-apwfuzz
Medium
medium.com › @lancersiromony › top-wordlist-for-hackers-in-2025-b7ed8e8dbfb9
Top WordList for Hackers in 2025. Choosing the Right Wordlist in SecLists… | by IronGhost | Medium
April 22, 2025 - SecLists is the security tester’s Swiss Army knife — a curated collection of wordlists for reconnaissance, fuzzing, brute-forcing, and vulnerability discovery. Created by Daniel Miessler and community contributors, it includes usernames, passwords, API endpoints, directories, and attack payloads.
Twitter
twitter.com › payloadartist › status › 1240591694753452032
payloadartist
March 19, 2020 - payloadartist
RequestBin Blog
blog.requestbin.net › top-wordlists-for-brute-force-attack
Top wordlists for Brute Force attack
December 8, 2024 - Brute force attacks can also be used to discover hidden pages and content in a web application. This attack is basically “a hit and try” until you succeed. This attack sometimes takes longer, but its success rate is higher. In this article, we will try to collect popular wordlists used in different scenarios for performing brute force attacks to get desired results.
GitHub
github.com › topics › bruteforce-wordlist
bruteforce-wordlist · GitHub Topics · GitHub
ssh exploit dictionary bruteforce ... ssh-brute-force ssh-hacking ssh-attack ssh-bruteforcer ssh-cracker exploitxpertz gui-hacking-tool ... A bruteforce hacking tool to hack and break into an Instagram accounts with weak passwords and get login details · linux instagram kali-linux hacking-tool instagram-bot bruteforce-attacks bruteforce-password-cracker bruteforce-wordlist instagram-hacker instagram-hack-tool hack-ins bruteforce-instagram ... wordpress wordpress-api xml ...