General-API-Wordlist: Contains wordlists for common API endpoints that are widely applicable.

A wordlist of API names used for fuzzing web application APIs.

December 29, 2022 - API endpoints & objects - Yassine Aboukir’s list of 3203 common API endpoints and objects designed for fuzzing · api-wordlist - A wordlist of API names for web application assessments

January 29, 2025 - Today we just rolled out a suite of new API endpoints designed to improve the experience with our Wordlists and Review Queues for enterprise plans. These enhancements offer greater flexibility if you're aiming to customise your moderation interface ...

January 27, 2025 - # Tools https://github.com/Fuzzapi/fuzzapi https://github.com/Fuzzapi/API-fuzzer https://github.com/flipkart-incubator/Astra https://github.com/BBVA/apicheck/ https://github.com/ngalongc/openapi_security_scanner https://github.com/assetnote/kiterunner https://github.com/s0md3v/dump/tree/master/json2paths https://github.com/API-Security/APIKit # API keys guesser https://api-guesser.netlify.app/ # Wordlists https://github.com/chrislockard/api_wordlist https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/common-api-endpoints-mazen160.txt https://github.com/danielmiessler/S

October 24, 2025 - Use API wordlists to discover hidden routes, API endpoint wordlists to check version paths, and API fuzzing wordlists to test how inputs are handled.

February 26, 2026 - CeWL is a powerful tool that can be used to generate custom wordlists for API discovery. Using CeWL with release notes, changelogs, and product roadmaps gives you the opportunity to discover endpoints before they are publicly documented.

In this case I always run a common wordlist like “directory-list-2.3-small.txt” or “common.txt” just in case the API endpoints contain commonly found words that aren’t that common with APIs. The best results I’ve had were API specific wordlists. SecLists has an entire section dedicated to APIs that could be used and there are tons of other wordlists that’ll be shown below, but I’d like to focus in on the wordlists provided by Assetnote.

April 21, 2024 - Type Interactive Apple Messages for Business REST API Rest Api Endpoint Wordlist List of api endpoints & objects this file contains bidirectional unicode text that may be interpreted or compiled differently than what.

September 30, 2022 - The kite runner has extensive and multiple options to scan domains and API endpoints with help of wordlists.

March 19, 2020 - Also: word list to fuzz against API endpoints (by @Yassineaboukir) gist.github.com/yassineaboukir…

3 weeks ago - curl --request GET \ --url https://api.pentest-tools.com/api/v2/wordlists \ --header 'Authorization: Bearer <token>'

December 1, 2024 - -> error says what missing params** — error -> try another data type (integer means without “”) - 6. brute-force for hidden endpoints via Intruder or ffuf — e.g. `PUT /api/user/update` found — can guess `delete` or `add` or others relevant to the application traits — `PUT /api/user/FUZZ` — use wordlists based on common API ``` /api/FUZZ /api/v1/FUZZ /FUZZ/api?

api wordlist · Raw · api_wordlist.txt · This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters ·

You can use the following YAML to hit the same API with multiple malicious file paths. ... wordLists: filePaths: - /etc/passwd - /etc/lsb-release - /etc/shadow - /etc/hosts - /proc/self/environ - /proc/self/cmdline - /proc/self/cwd/index.php - /proc/self/cwd/application.py - /proc/self/cwd/main.py" - /proc/self/exe execute: type: single requests: - req: - modify_query_param: file: ${filePaths} # this is how you refer to a wordlist ${wordlist_name}

Try the SquareSec custom-made collection of 9 API fuzzing wordlists. Scraped from more than 120,000 public documentations, it contains fuzzing payloads for API ports, paths, parameters, objects, headers and many more: 744,000+ endpoints · 357,000+ object properties ·

March 27, 2026 - Location: SecLists/Discovery/Web-Content/api/api-endpoints.txt Also: chrislockard/api_wordlist

May 17, 2023 - This is how you can use Feroxbuster to fuzz an API and find hidden endpoints that have no links in the app and are not mentioned in the API's documentation.

June 27, 2025 - This system provides curated wordlists that enable systematic enumeration of API endpoints through combinatorial wordlist attacks using Burp Suite's Cluster Bomb functionality.