GitHub
github.com › danielmiessler › SecLists › blob › master › Discovery › Web-Content › common-api-endpoints-mazen160.txt
SecLists/Discovery/Web-Content/common-api-endpoints-mazen160.txt at master · danielmiessler/SecLists
It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
GitHub
github.com › danielmiessler › SecLists › blob › master › Discovery › Web-Content › api › api-endpoints.txt
SecLists/Discovery/Web-Content/api/api-endpoints.txt at master · danielmiessler/SecLists
It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Author: danielmiessler
Weekly Discussion, January 20, 2020: Ask all your bugbounty questions!
How do I find API end points? New to bug hunting and any help would be much appreciated.
More on reddit.com 8
9
January 21, 2020Looking for API fuzzing wordlists
http://wordlists.assetnote.io More on reddit.com
7
10
March 30, 2024Oracle
docs.oracle.com › en › cloud › iaas-classic › compute-iaas-cloud › stcsa › api-seclists.html
REST API for Oracle Cloud Infrastructure Compute Classic - SecLists REST Endpoints
REST API for Oracle Cloud Infrastructure Compute Classic · Tasks · SecLists · A security list is a group of one or more instances that you can specify as the destination or source in a security rule. Instances within a security list can communicate fully with one another on all ports.
GitHub
github.com › danielmiessler › SecLists › blob › master › Discovery › Web-Content › api › api-endpoints-res.txt
SecLists/Discovery/Web-Content/api/api-endpoints-res.txt at master · danielmiessler/SecLists
It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Author: danielmiessler
Pentest-book
pentest-book.com › enumeration › webservices › apis
APIs | Pentest Book
January 27, 2025 - # Tools https://github.com/Fuz... https://github.com/chrislockard/api_wordlist https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/common-api-endpoints-mazen160.txt https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content/api ...
Zero Day Hacker
zerodayhacker.com › home › api hacking › discover api endpoints with feroxbuster
Discover API endpoints with Feroxbuster - Zero Day Hacker
May 17, 2023 - We can start by scanning the app with the following command: feroxbuster -u http://192.168.1.26:8000/api/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -H 'Authorization: Token eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6IlNhbW15IiwiZXhwIjoxNjgzNTgwODE2LCJzdWIiOiJhY2Nlc3MifQ.QCYFvWCrs74U_6bs8SYx6hR5QhjKHkKOwdJh9x8tlIo' ... -u http://192.168.1.26:8000/api/ this set the URL we want to fuzz (in c{cap}ital, all API endpoints are located in the /api path).
GitHub
github.com › danielmiessler › SecLists › tree › master › Discovery › Web-Content › api
SecLists/Discovery/Web-Content/api at master · danielmiessler/SecLists
This directory contains wordlists for fuzzing web application APIs.
Author: danielmiessler
GitHub
github.com › danielmiessler › SecLists › pull › 136 › files
Added @mazen160 wordlist for common web API endpoints. by mazen160 · Pull Request #136 · danielmiessler/SecLists
174 changes: 174 additions & 0 deletions 174 Discovery/Web_Content/MAZEN160_COMMON_API_ENDPOINTS.txt
Author: danielmiessler
Internet Archive
archive.org › software
github.com-arainho-awesome-api-security_-_2022-01-07_21-22-17 : arainho : Free Download, Borrow, and Streaming : Internet Archive
|| List of Swagger endpoints | Swagger endpoints || SecLists for API's web-content discovery | It is a collection of web content discovery lists for APIs used during security assessments.
GitHub
github.com › danielmiessler › SecLists › actions › workflows › wordlist-updater_api-endpoints-res.yml
Wordlist Updater - API Endpoints Res · Workflow runs · danielmiessler/SecLists
It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Author: danielmiessler
GitLab
darenet.dev › terrance robotham › seclists › repository
Discovery/Web-Content/api · master · Terrance Robotham / SecLists · GitLab
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs,...
Medium
medium.com › @lancersiromony › top-wordlist-for-hackers-in-2025-b7ed8e8dbfb9
Top WordList for Hackers in 2025. Choosing the Right Wordlist in SecLists… | by IronGhost | Medium
April 22, 2025 - SecLists is the security tester’s Swiss Army knife — a curated collection of wordlists for reconnaissance, fuzzing, brute-forcing, and vulnerability discovery. Created by Daniel Miessler and community contributors, it includes usernames, passwords, API endpoints, directories, and attack payloads.
GitHub
github.com › danielmiessler › SecLists › blob › master › Discovery › Web-Content › api › api-seen-in-wild.txt
SecLists/Discovery/Web-Content/api/api-seen-in-wild.txt at master · danielmiessler/SecLists
It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Author: danielmiessler
Danaepp
danaepp.com › home › blog › 5 big mistakes beginners make hacking apis
5 big mistakes beginners make hacking APIs - Dana Epp's Blog
February 26, 2026 - There is a great wordlist designed specifically for finding API documentation through enumeration called swagger.txt, which is part of Daniel Miessler’s SecLists repository.
Twitter
twitter.com › mazen160 › status › 911223901748973568
Mazin Ahmed on X: "I'm making a wordlist for common API endpoints for the SecLists project. https://t.co/ZXTwKdapF0 Feel free to contribute!" / X
September 22, 2017 - I'm making a wordlist for common API endpoints for the SecLists project. https://t.co/ZXTwKdapF0 Feel free to contribute!
SecLists
seclists.org › fulldisclosure › 2023 › Feb › 11
Full Disclosure: Sumo Logic keep api credentials on endpoints
February 18, 2023 - Full Disclosure mailing list archives · By Date · By Thread · Sumo Logic keep api credentials on endpoints · From: dammitjosie--- via Fulldisclosure <fulldisclosure () seclists org> Date: Sat, 18 Feb 2023 02:42:46 +0100 (CET) · security bug: go sumologic.com (big company, many customer) ...
Reddit
reddit.com › r › bugbounty › comments › eraatr › weekly_discussion_january_20_2020_ask_all_your
r/bugbounty - Weekly Discussion, January 20, 2020: Ask all your bugbounty questions!
January 21, 2020 -
Please utilize this sticky thread for all general discussions!
Here are the general rules:
If you'd like to learn something, ask.
If you'd like to share knowledge, answer.
Any discussion about bug bounty is fair game.
You can sort by new to see the latest questions that may not be answered yet.
Top answer 1 of 3
2
How do I find API end points? New to bug hunting and any help would be much appreciated.
2 of 3
1
This is a total newbie question but it’s something I unfortunately haven’t been able to understand for a long time. A lot of exploiting JavaScript write ups say something like this, which is from a port swifter writeup here:
https://portswigger.net/web-security/cross-site-scripting/dom-based
“To test for DOM XSS in an HTML sink, place a random alphanumeric string into the source (such as location.search), then use developer tools to inspect the HTML and find where your string appears.”
How do I place the string into the source exactly? Use the developer tools console? Thank you!
Medium
coffsec.medium.com › 10-recon-wordlists-every-pentester-must-know-484499d2ce9c
10 Recon Wordlists Every Pentester Must Know | by COFFSec | Medium
March 27, 2026 - Location: SecLists/Discovery/Web-Content/api/api-endpoints.txt Also: chrislockard/api_wordlist
SecLists
seclists.org › fulldisclosure › 2021 › May › 72
Full Disclosure: KL-001-2021-001: CommScope Ruckus IoT Controller Unauthenticated API Endpoints
May 26, 2021 - Two of the endpoints result in information leakage and consumption of computing/storage resources. The third API endpoint that does not require authentication allows for a factory reset of the IoT Controller. 3. Technical Description A "service details" API endpoint discloses system and configuration information to an attacker without requiring authentication.
Reddit
reddit.com › r/bugbounty › looking for api fuzzing wordlists
r/bugbounty on Reddit: Looking for API fuzzing wordlists
March 30, 2024 -
I don't think it needs much more explanation, I've been trying to dig into good api fuzzing wordlist but mostly only came across general purpose ones in seclists, dirb, etc. Any good finding you would be kind enough to share?