idan/SecLists
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
740 Commits 1 Branch 0 Tags
37bb3c0f4dc3ada058aa8cc33e3617135bc9df36
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
g0tmi1kandGitHub 162c2ee368 Merge pull request #328 from hisxo/patch-1 
Create symfony wordlist (for LFI/Path Traversal)

Source: https://github.com/hisxo/wordlist
 2019-08-13 04:36:15 -07:00
g0tmi1kandGitHub fd95031f64 Merge pull request #330 from denzuko/patch-2 
Create stupid-ones-in-production.txt
 2019-08-13 04:35:59 -07:00
g0tmi1kandGitHub aeeac3d7ef Merge pull request #331 from ericrange/patch-2 
new config file locations
 2019-08-13 04:35:31 -07:00
g0tmi1kandGitHub 1f6c4c10bf Merge pull request #326 from toxydose/patch-1 
add Dot CMS login endpoint

Source: https://dotcms.com/docs/latest/logging-into-dotcms
 2019-07-29 14:42:12 +01:00
g0tmi1kandGitHub 3c3fc7c89e Merge pull request #325 from toxydose/patch-2 
add weevely.php shell endpoint

Source: https://tools.kali.org/maintaining-access/weevely
 2019-07-26 13:57:15 +01:00
g0tmi1kandGitHub d99ade3d0c Merge pull request #324 from Glassware123/patch-1 
Update vnc-betterdefaultpasslist.txt
 2019-07-26 12:32:38 +01:00
g0tmi1kandGitHub 3019f92124 Merge pull request #321 from toxydose/patch-1 
add /phpmyadmin/ endpoints
 2019-07-21 08:42:05 +01:00
g0tmi1kandGitHub 40eeff6fc5 Merge pull request #318 from mbiert/readme-git-path 
Fix git clone complete path
 2019-07-12 11:40:07 +01:00
g0tmi1kandGitHub fab1f77a7d Merge pull request #317 from maxence-schmitt/patch-1 
Adding sha256 magic hash

Source: https://github.com/spaze/hashes/blob/master/README.md
 2019-07-11 14:48:53 +01:00
g0tmi1kandGitHub f0438d39e3 Merge pull request #316 from g0tmi1k/misc 
Close #154 - 1.4 billion password breach compilation wordlist
 2019-07-09 12:15:50 +01:00
g0tmi1kandGitHub 503c57f500 Merge pull request #314 from jakobhuss/patch-1 
Non valid ipv4
 2019-07-05 17:22:13 +01:00
g0tmi1kandGitHub c94bdb754c Merge pull request #315 from toxydose/master 
Created Sitecore CMS wordlist + minor endpoint updates.

Sitecore CMS:  https://www.sitecore.com/

Sensitive endpoints: https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/deny-anonymous-users-access-to-a-folder.html

Sitecore docs:  
https://doc.sitecore.com/legacy-docs/SC72/sitecore-web-service-sc65-a4.pdf
https://doc.sitecore.com/SdnArchive/upload/sitecore7/75/sitecore_security_hardening_guide-sc75-usletter.pdf

Contains sensitive info
https://zellwk.com/blog/bower/
 2019-07-05 17:20:28 +01:00
g0tmi1kandGitHub c9a56c3fe0 Merge pull request #312 from g0tmi1k/richelieu 
Add richelieu
 2019-07-03 14:11:25 +01:00
g0tmi1kandGitHub e06b13d36d Merge pull request #310 from waawaa/patch-1 
Missing paths with known RCE vulnerabilities

- https://www.exploit-db.com/exploits/46814
- https://www.exploit-db.com/exploits/43458
- https://paper.seebug.org/910/
- https://techblog.mediaservice.net/2018/07/cve-2017-10271-oracle-weblogic-server-remote-command-execution-sleep-detection-payload/
 2019-07-02 14:16:55 +01:00
g0tmi1kandGitHub b0cbe86a20 Merge pull request #306 from g0tmi1k/phpinfo 
Add a few more filenames

Based on https://anotherhackerblog.com/exploiting-file-uploads-pt1/
 2019-06-07 11:07:47 +01:00
g0tmi1kandGitHub b5de230180 Merge pull request #305 from g0tmi1k/guardicore 
Add MSSQL from guardicore: labs_campaigns-Nansh0u

Source: https://github.com/guardicore/labs_campaigns/blob/master/Nansh0u/common_passwords.txt
Source: https://github.com/guardicore/labs_campaigns/blob/master/Nansh0u/common_usernames.txt
 2019-05-30 12:24:56 +01:00
g0tmi1kandGitHub 28db64c6e2 Merge pull request #304 from g0tmi1k/xss 
Add XSS without parentheses and semi-colons

Source: https://portswigger.net/blog/xss-without-parentheses-and-semi-colons
 2019-05-22 12:18:18 +01:00
g0tmi1kandGitHub a176d0ccff Merge pull request #301 from g0tmi1k/Fixes 
Give credit where its due!
 2019-05-08 15:35:25 +01:00
g0tmi1kandGitHub 379fba7854 Merge pull request #300 from g0tmi1k/Fixes 
Better filenames
 2019-05-08 12:30:24 +01:00
g0tmi1kandGitHub 37fce3b2c1 Merge pull request #299 from g0tmi1k/Fixes 
Source: https://github.com/chrislockard/api_wordlist
 2019-05-08 12:22:50 +01:00
g0tmi1kandGitHub bb915befb2 Merge pull request #298 from g0tmi1k/Fixes 
Close #291 - Fix encoding issues

```
$ for x in $( find . -type f ); do iconv -f utf-8 -t utf-8 -c ${x} | sed '/^$/d' > tmp; mv tmp ${x}; done
```
 2019-05-08 11:08:05 +01:00
g0tmi1kandGitHub 3c8ddaf468 Merge pull request #297 from g0tmi1k/Fixes 
Close #293 - Ten Million Passwords

Source: https://xato.net/today-i-am-releasing-ten-million-passwords-b6278bbe7495

https://wpengine.com/unmasked/

https://mega.nz/#!SdYnkJRJ!HmD04LH8Gk8JtlNG6O2NnF2yH9qWJPWtSXbLU2ZR9Q8


```
$ awk -F '\t' '{print $1}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-usernames.txt
$ awk -F '\t' '{print $2}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-passwords.txt
$ awk -F '\t' '{print $1}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | grep -v ' 1 ' | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-usernames-dup.txt
$ awk -F '\t' '{print $2}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | grep -v ' 1 ' | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-passwords-dup.txt
```
 2019-05-08 10:33:10 +01:00
g0tmi1kandGitHub 004af903c4 Merge pull request #296 from g0tmi1k/Fixes 
Close #294 - Add /weblogic/ready
 2019-05-07 18:20:50 +01:00
g0tmi1kandGitHub 9e5f97fac5 Merge pull request #292 from Beverdam/master 
Added NCSC top 100K most used passwords

Source: https://www.ncsc.gov.uk/static-assets/documents/PwnedPasswordTop100k.txt
https://www.ncsc.gov.uk/blog-post/passwords-passwords-everywhere
 2019-05-07 17:49:26 +01:00
g0tmi1kandGitHub 181bd743eb Merge pull request #290 from ricardojba/master 
Include .well-known/apple-app-site-association

Source: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/april/apples_app_site_association_the_new_robots_txt/
 2019-04-12 16:31:18 +01:00
g0tmi1kandGitHub 7ccb85c376 Merge pull request #289 from toxydose/master 
minor updates
 2019-04-10 14:16:40 +01:00
g0tmi1kandGitHub aca3a1bb5c Merge pull request #286 from bkimminich/master 
Add worlds-safest-password list by Der Postillon

Source: https://www.der-postillon.com/2014/04/it-experten-kuren-mb2r5ohf-0t-zum.html
 2019-04-05 08:35:35 +01:00
g0tmi1kandGitHub ed69bd3738 Merge pull request #282 from drwetter/master 
Suggestion to avoid license files to be added per accident
 2019-03-19 09:30:26 +00:00
g0tmi1kandGitHub bca680eef5 Merge pull request #281 from Zawadidone/patch-1 
Update IIS.fuzz.txt

Source: https://twitter.com/mrr0y4l3/status/1106602488495525888?s=12
 2019-03-18 19:17:26 +00:00
g0tmi1kandGitHub 067e5cfc01 Merge pull request #280 from drwetter/master 
Adding more springboot entrypoints

Source: https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#production-ready-endpoints
 2019-03-17 11:30:53 +00:00
g0tmi1kandGitHub 6830bbe052 Merge pull request #278 from tkisason/patch-1 
Update spring-boot.txt

Source: https://www.veracode.com/blog/research/exploiting-spring-boot-actuators
 2019-03-16 20:31:21 +00:00
g0tmi1kandGitHub 75ea478e81 Merge pull request #279 from ArgentEnergy/new-web-paths 
New web paths
 2019-03-16 11:37:57 +00:00
g0tmi1kandGitHub ca946eefff Merge pull request #277 from noraj/patch-2 
simple-shell.jsp: fix file
 2019-03-11 16:59:45 +00:00
g0tmi1kandGitHub 9196a19470 Merge pull request #274 from noraj/patch-1 
Update LFI-JHADDIX.txt
 2019-03-11 07:12:44 +00:00
g0tmi1kandGitHub 8087c4ba5d Merge pull request #273 from leesoh/master 
Add "admin"
 2019-02-23 08:17:14 +00:00
g0tmi1kandGitHub 73a4b826e8 Merge pull request #272 from govolution/patch-1 
Update vagrant credentials

Source: https://app.vagrantup.com/peru/boxes/windows-10-enterprise-x64-eval
 2019-02-21 14:46:43 +00:00
g0tmi1kandGitHub 70958f58b6 Merge pull request #271 from SolomonSklash/patch-1 
Fixed typo in file name.
 2019-02-20 10:06:14 +00:00
g0tmi1kandGitHub 5704666b23 Merge pull request #270 from g0tmi1k/fix-226 
Fix #226 - Remove 255+ file names
 2019-02-10 20:13:48 +00:00
g0tmi1kandGitHub 56d8922757 Merge pull request #269 from 0xInfection/patch-1 
A wrong payload corrected
 2019-02-10 19:37:49 +00:00
g0tmi1kandGitHub 069c301733 Merge pull request #268 from xpirt/patch-1 
add /admin-console directory
 2019-02-08 16:17:28 +00:00
g0tmi1kandGitHub 72d9141eb4 Update secretkeywords.txt 
As requested ~ https://github.com/danielmiessler/SecLists/pull/267#issuecomment-458900997
 2019-01-30 11:12:02 +00:00
g0tmi1kandGitHub a0c2048867 Merge pull request #267 from nsonaniya2010/master 
new secret keywords added

Source: https://github.com/nsonaniya2010/SubDomainizer/blob/55899c0ee0769a521f49edaf88da97a0f951e4b5/SubDomainizer.py#L174
 2019-01-30 10:52:00 +00:00
g0tmi1kandGitHub 63396f101c Merge pull request #266 from theguly/master 
guly: added shubs lists

Source:
- https://raw.githubusercontent.com/assetnote/commonspeak2-wordlists/master/subdomains/subdomains.txt
- https://raw.githubusercontent.com/pentester-io/commonspeak/master/stackoverflow/output/compiled/stackoverflow_2017_10_22.urls_subdomains.txt
 2019-01-30 10:28:52 +00:00
g0tmi1kandGitHub 4264cf5ffd Merge pull request #265 from speedinternet/smfixes 
removes exec. bits
 2019-01-27 20:36:06 +00:00
g0tmi1kandGitHub 838ada9e20 Merge pull request #263 from IndiNijhof/patch-1 
Update ftp-betterdefaultpasslist.txt
 2019-01-27 09:13:16 +00:00
g0tmi1kandGitHub 7ed3f897df Merge pull request #237 from s0md3v/patch-1 
+5 payloads, some enhancements
 2019-01-08 18:11:33 +00:00
g0tmi1kandGitHub a012b65235 Typo 2019-01-07 15:58:27 +00:00
g0tmi1kandGitHub 8f3802fd51 Merge pull request #262 from g0tmi1k/websphere 
Fix #255 - Add more wps
 2019-01-07 15:55:58 +00:00
g0tmi1kandGitHub 470bb32840 Merge pull request #256 from Prinzhorn/LFI-LFISuite-pathtotest-huge 
Strip HTML from LFI-LFISuite-pathtotest-huge.txt
 2019-01-07 15:50:48 +00:00
g0tmi1kandGitHub ddb1eb2ccb Merge pull request #258 from henry701/patch-1 
Fix row collumn quantity to 4
 2019-01-07 15:50:20 +00:00
g0tmi1kandGitHub 8103bbddb8 Merge pull request #261 from g0tmi1k/readme 
Fix README - URLs and extra resources
 2019-01-07 15:50:06 +00:00
g0tmi1kandGitHub d19c482b75 Merge pull request #260 from g0tmi1k/recover 
Fix #259 - Recover from bad merge
 2019-01-07 15:41:59 +00:00
g0tmi1kandGitHub f9c1ec678c Merge pull request #253 from toxydose/master 
Merge and delete vordlists, add login.html to Logins.fuzz.txt
 2018-12-11 11:33:42 +00:00
g0tmi1kandGitHub 3e30797df9 Merge pull request #254 from g0tmi1k/snmp 
Made OneSixtyOne happy with SNMP
 2018-12-11 11:25:22 +00:00
g0tmi1kandGitHub 692a3a3cb9 Merge pull request #252 from Natfan/patch-1 
Updated this file to be a real CSV file.
 2018-12-11 11:24:55 +00:00
g0tmi1kandGitHub cdf9fce969 Merge pull request #251 from chokeee/patch-1 
Update README.md
 2018-12-09 09:48:53 +00:00
g0tmi1kandGitHub a28f62c52e Merge pull request #250 from francisuk1989/patch-1 
dietpi

Source: https://dietpi.com/#download
 2018-12-09 09:48:37 +00:00
g0tmi1kandGitHub 3afd36dd5c Merge pull request #249 from toxydose/master 
Removed duplicates, merged files in /Discovery/Web-Content/
 2018-12-08 15:56:24 +00:00
g0tmi1kandGitHub 719bdb02a2 Merge pull request #248 from toxydose/master 
merged two coldfusion.fuzz files and deleted duplicates
 2018-12-07 14:33:08 +00:00
g0tmi1kandGitHub f17d80a8fb Merge pull request #247 from toxydose/master 
add Atlassian Confluence login endpoints

Source: https://confluence.atlassian.com/doc/customizing-the-login-page-163938553.html
 2018-12-06 09:25:19 +00:00
g0tmi1kandGitHub cbf2229610 Merge pull request #246 from nsonaniya2010/secretKeywords 
List Addition - A list of secret related keywords should be added
 2018-12-03 10:12:21 +00:00
g0tmi1kandGitHub da5d8c8125 Merge pull request #243 from toxydose/master 
some additions and editions
 2018-12-02 07:46:22 +00:00
g0tmi1kandGitHub b8da13eb6e Update README.md 2018-11-26 10:20:38 +00:00
g0tmi1kandGitHub 691bc9bd72 Merge pull request #242 from g0tmi1k/misc 
Add install information
 2018-11-26 10:19:59 +00:00
g0tmi1kandGitHub 47b1829910 Merge pull request #241 from g0tmi1k/ua 
Added various User Agent strings
 2018-11-26 10:09:44 +00:00
g0tmi1kandGitHub 75ebcd1e1f Merge pull request #240 from vinnytroia/1m_domains 
Added top 1m Alexa domains 

Source: https://www.alexa.com/topsites
 2018-11-23 10:01:54 +00:00
g0tmi1kandGitHub ea79b4facb Merge pull request #239 from tomcodes/master 
Add sonar-project.properties and default HashiChorp Vault url to quickhits.txt

Source: https://docs.sonarqube.org/display/SCAN/Analyzing+with+SonarQube+Scanner
 2018-11-21 15:16:08 +00:00
g0tmi1kandGitHub 933f1d5fba Merge pull request #238 from tomcodes/master 
Add AWS CodeDeploy appspec.yml file to quickhits.txt

Source: https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file.html
 2018-11-21 14:42:13 +00:00
g0tmi1kandGitHub e5b7acdea2 Merge pull request #234 from Martin407/patch-1 
Removed duplicate entry
 2018-11-13 17:01:10 +00:00
g0tmi1kandGitHub f28cd4a37c Merge pull request #232 from michenriksen/master 
Add best performing payloads from the XSS Polyglot Challenge

Source: https://polyglot.innerht.ml/
 2018-11-01 08:09:01 +00:00
g0tmi1kandGitHub f8343e454d Merge pull request #231 from toxydose/master 
WP REST API v2 endpoints

Source: http://v2.wp-api.org/
 2018-10-31 21:31:17 +00:00
g0tmi1kandGitHub e36d634b08 Merge pull request #230 from toxydose/master 
Add cpanel login page

Source: https://www.webhostinghub.com/help/learn/cpanel/getting-started/how-to-login-to-cpanel
 2018-10-30 18:02:16 +00:00
g0tmi1kandGitHub 3327ec8b40 Merge pull request #229 from drwetter/patch-1 
Correct 1 typo in typo3 login ;-)
 2018-10-23 12:53:05 +01:00
g0tmi1kandGitHub f5fcb3ca9b Merge pull request #228 from toxydose/master 
Add Wordpress, Django, Flask and Shopware login pages
 2018-10-23 12:51:09 +01:00
g0tmi1kandGitHub 6a18428339 Merge pull request #227 from toxydose/master 
Add Shopware common sensitive files wordlist.
 2018-10-17 15:22:55 +01:00
g0tmi1kandGitHub 42d23ebe37 Merge pull request #225 from g0tmi1k/fixes 
Fixes
 2018-10-15 13:09:51 +01:00
g0tmi1kandGitHub 7efce4c385 Merge pull request #224 from s0md3v/patch-1 
Hand crafted XSS payloads to bypass WAFs

Source: https://github.com/s0md3v/AwesomeXSS
 2018-10-15 11:43:19 +01:00
g0tmi1kandGitHub 11bea7627e Merge pull request #223 from govolution/patch-3 
Update telnet-betterdefaultpasslist.txt

Source: https://github.com/govolution/betterdefaultpasslist/blob/master/sources.txt
 2018-10-10 11:23:52 +01:00
g0tmi1kandGitHub 31775a887e Merge pull request #222 from govolution/patch-2 
Update ssh-betterdefaultpasslist.txt

Source: https://github.com/govolution/betterdefaultpasslist/blob/master/sources.txt
 2018-10-10 11:23:16 +01:00
g0tmi1kandGitHub 19e46c19bc Merge pull request #221 from govolution/patch-1 
Add 1 default credential

Source: https://app.vagrantup.com/brunofpereira/boxes/ubuntu-base
 2018-10-10 11:22:38 +01:00
g0tmi1kandGitHub 9588809bce Merge pull request #220 from JensTimmerman/patch-1 
add default passwords for zenitel devices

Source: https://wiki.zenitel.com/wiki/Password_(IP_Stations)
 2018-10-08 14:41:00 +01:00
g0tmi1kandGitHub 4779684635 Merge pull request #219 from kongwenbin/master 
Add new word list for Content Type
 2018-10-07 18:27:20 +01:00
g0tmi1kandGitHub f8987930ef Merge pull request #218 from s7x/master 
Cleaned and added the headers from @albinowax's BurpSuite param-miner Extension

Source: https://github.com/PortSwigger/param-miner/tree/05d4da39617457bdbc95c5c2127b9bcc6dc5c130/resources
 2018-10-05 13:40:05 +01:00
g0tmi1kandGitHub 6b0d4132bf Merge pull request #216 from hitericcow/patch-1 
Update default-passwords.csv
 2018-10-03 12:49:39 +01:00
g0tmi1kandGitHub df9c03a922 Merge pull request #213 from objectified/feature/spring-boot 
added wordlist for Spring Boot (Actuator)
 2018-08-24 15:01:05 +01:00
g0tmi1kandGitHub 3bd766edd2 Merge pull request #212 from tehmoon/patch-1 
Update default-passwords.csv

Source: https://business.comcast.com/help-and-support/internet/setup-manage-comcast-wifi-business-wireless-gateway/
 2018-08-23 08:18:27 +01:00
g0tmi1kandGitHub f25da401da Merge pull request #211 from melardev/add-resolvers-txt 
Resolvers file for subdomain brute force
 2018-07-26 10:40:35 +01:00
g0tmi1kandGitHub 5d2035a074 Merge pull request #210 from g0tmi1k/fixes 
Add LFISuite
 2018-07-25 14:01:31 +01:00
g0tmi1kandGitHub e708bec362 Merge pull request #209 from g0tmi1k/fixes 
Improved on File-names payloads
 2018-07-25 12:27:13 +01:00
g0tmi1kandGitHub cd9b3c6568 Merge pull request #208 from om3rcitak/patch-1 
fix typo
 2018-07-23 08:08:10 +01:00
g0tmi1kandGitHub 9c67af9639 Merge pull request #207 from govolution/master 
Added tomcat & added pw to mysql list
 2018-07-12 21:42:28 +01:00
g0tmi1kandGitHub 2e9947bb8b Merge pull request #205 from govolution/master 
Source ~ https://github.com/govolution/betterdefaultpasslist/blob/master/sources.txt
 2018-07-09 07:14:34 +01:00
g0tmi1kandGitHub 274c088af1 Merge pull request #204 from g0tmi1k/fixes 
Fixes
 2018-07-05 07:22:30 +01:00
g0tmi1kandGitHub 321f88e093 Merge pull request #203 from govolution/master 
Added credentials
 2018-07-05 07:10:49 +01:00
g0tmi1kandGitHub 591e4962a8 Merge pull request #202 from frite/jhaddix-dns-entries 
Adding jhaddix DNS entries file.
 2018-07-02 07:05:26 +01:00
g0tmi1kandGitHub c196a6e62d Close #200 - Attribution for @erose1337 2018-06-21 07:36:54 +01:00
g0tmi1kandGitHub a6abbd5298 Merge pull request #201 from PaulSec/master 
Added CIRT default usernames/passwords from https://cirt.net/passwords
 2018-06-21 07:31:42 +01:00
g0tmi1kandGitHub 6cb32c5e0e Merge pull request #199 from g0tmi1k/fixes 
Quick move about for #198
 2018-06-19 08:00:56 +01:00
g0tmi1kandGitHub e907d3acaf Close #193 ~ Merge pull request #198 from erose1337/master 
Security question answers
 2018-06-19 07:47:32 +01:00
g0tmi1kandGitHub 70414208e1 Update README.md 2018-06-13 12:14:09 +01:00