idan/SecLists
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
1,011 Commits 1 Branch 0 Tags
4006e184baa17bad9d3c5bcf1c5af90e76aeb04e
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
g0t mi1k 4006e184ba Update CONTRIBUTORS 2020-11-03 11:53:17 +00:00
g0t mi1k 59a8f512af Add Magento webshells 2020-11-03 11:51:54 +00:00
g0t mi1k 75f5d656c1 Add Invisible control characters 2020-11-03 11:51:18 +00:00
g0t mi1k df66ea4c82 Fix issues with wordlists 2020-07-22 16:19:47 +01:00
g0t mi1k 3567cf6fc0 Writable locations Windows 
Source: https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/Generic-AppLockerbypasses.md

accesschk -w -s -q -u Users "C:\Program Files" >> programfiles.txt
accesschk -w -s -q -u Everyone "C:\Program Files" >> programfiles.txt
accesschk -w -s -q -u "Authenticated Users" "C:\Program Files" >> programfiles.txt
accesschk -w -s -q -u Interactive "C:\Program Files" >> programfiles.txt

accesschk -w -s -q -u Users "C:\Program Files (x86)" >> programfilesx86.txt
accesschk -w -s -q -u Everyone "C:\Program Files (x86)" >> programfilesx86.txt
accesschk -w -s -q -u "Authenticated Users" "C:\Program Files (x86)" >> programfilesx86.txt
accesschk -w -s -q -u Interactive "C:\Program Files (x86)" >> programfilesx86.txt

accesschk -w -s -q -u Users "C:\Windows" >> windows.txt
accesschk -w -s -q -u Everyone "C:\Windows" >> windows.txt
accesschk -w -s -q -u "Authenticated Users" "C:\Windows" >> windows.txt
accesschk -w -s -q -u Interactive "C:\Windows" >> windows.txt
 2020-07-22 16:05:54 +01:00
g0t mi1k 7bc157fd55 2020.2 release 2020-05-04 10:22:21 +01:00
g0t mi1k ff36e7e79f Add alexa domains 
Source: https://support.alexa.com/hc/en-us/articles/200461990-Can-I-get-a-list-of-top-sites-from-an-API-
https://asciinema.org/a/9dwog4uqepaghpvyeginwckpn
 2020-05-04 10:18:55 +01:00
g0t mi1k fe8a8830c4 Add majestic domains 
Source: https://blog.majestic.com/development/majestic-million-csv-daily/

$ wget http://downloads.majestic.com/majestic_million.csv
$ zip top-domains-majestic.csv.zip majestic_million.csv
 2020-05-04 10:16:48 +01:00
g0t mi1k cd715ee89c Update credit URLs 2020-05-04 10:10:52 +01:00
g0t mi1k 46f55b814f Add CFM Shell 
Source: http://pastebin.com/3HKGQCWF // https://web.archive.org/web/20170322222809/http://pastebin.com/3HKGQCWF
 2020-03-25 13:25:00 +00:00
g0t mi1k 9428544c6f Add author table 2019-12-02 22:01:59 +00:00
g0t mi1k 73cd7d6577 Add creds for web-shells 2019-12-02 21:58:53 +00:00
g0tmi1k 7ebceb210a Add more zip-bombs 
Source: https://www.bamsoftware.com/hacks/zipbomb/
 2019-08-18 11:34:35 +01:00
g0tmi1k 327cc859ee Quick rename 2019-08-13 12:50:53 +01:00
g0tmi1k 5bbc1e6fe3 Close #329 - Bo0oM's fuzz.txt 
Source: https://github.com/Bo0oM/fuzz.txt
 2019-08-13 12:50:20 +01:00
g0tmi1k 1f2a491ee4 Recover from #322 
#322 & #323 relate
 2019-08-13 12:44:52 +01:00
g0tmi1k 37bb3c0f4d Add scrabble 
Source: https://github.com/hackerhouse-opensource/tools/blob/https://github.com/hackerhouse-opensource/tools/commit/4cf8811b8f744a15c5514a6fca723ea062e62bf5/SCRABBLE-wordlist.tgz
 2019-08-13 12:42:49 +01:00
g0tmi1k 11b967a88f Merge branch 'master' of https://github.com/danielmiessler/SecLists into misc 
# Conflicts:
#	Discovery/Infrastructure/common-router-ips.txt
 2019-07-09 12:15:28 +01:00
g0tmi1k 1d768dbf9a Clean up other file to match 2019-07-09 12:13:37 +01:00
g0tmi1k 465a00dbe0 Close #154 - 1.4 billion password breach compilation wordlist 2019-07-09 12:12:33 +01:00
g0tmi1k f455dc518a Sort common-router-ip by pop 2019-07-09 12:06:25 +01:00
g0tmi1k ad53a28ba0 Rename a few filesto match 2019-07-03 14:11:00 +01:00
g0tmi1k cb68eaf66a Add richelieu 
Source: https://github.com/tarraschk/richelieu
 2019-07-03 14:04:48 +01:00
g0tmi1k 4257643de8 Add a few more filenames 
based on https://anotherhackerblog.com/exploiting-file-uploads-pt1/
 2019-06-07 11:06:35 +01:00
g0tmi1k 23901ce7b6 Fix make-*.sh files 2019-06-07 10:59:39 +01:00
g0tmi1k 6d1ff64270 Add MSSQL from guardicore: labs_campaigns-Nansh0u 
Source: https://github.com/guardicore/labs_campaigns/blob/master/Nansh0u/common_passwords.txt
Source: https://github.com/guardicore/labs_campaigns/blob/master/Nansh0u/common_usernames.txt
 2019-05-30 12:20:13 +01:00
g0tmi1k 3fc464d156 Add XSS without parentheses and semi-colons 
Source: https://portswigger.net/blog/xss-without-parentheses-and-semi-colons
 2019-05-22 12:15:42 +01:00
g0tmi1k 1c84d5f112 Give credit where its due! 2019-05-08 12:46:39 +01:00
g0tmi1k c731e1c9aa Better filenames 2019-05-08 12:28:10 +01:00
g0tmi1k 7f083ceb07 Close #217 - Add api_wordlist 
Source: https://github.com/chrislockard/api_wordlist
 2019-05-08 12:22:03 +01:00
g0tmi1k 782d018267 Cleaned up filename phpBB 2019-05-08 12:08:11 +01:00
g0tmi1k 9239f0a284 find . -name '*_*' -exec rename 's/_/-/g' "{}" \; 2019-05-08 11:54:39 +01:00
g0tmi1k a65f6bd665 Close #291 - Fix encoding issues 
$ for x in $( find . -type f ); do iconv -f utf-8 -t utf-8 -c ${x} | sed '/^$/d' > tmp; mv tmp ${x}; done
 2019-05-08 11:04:00 +01:00
g0tmi1k 6d3b37a3c9 Close #293 - Ten Million Passwords 
Source: https://xato.net/today-i-am-releasing-ten-million-passwords-b6278bbe7495

https://wpengine.com/unmasked/

https://mega.nz/#!SdYnkJRJ!HmD04LH8Gk8JtlNG6O2NnF2yH9qWJPWtSXbLU2ZR9Q8

$ awk -F '\t' '{print $1}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-usernames.txt
$ awk -F '\t' '{print $2}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-passwords.txt
$ awk -F '\t' '{print $1}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | grep -v ' 1 ' | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-usernames-dup.txt
$ awk -F '\t' '{print $2}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | grep -v ' 1 ' | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-passwords-dup.txt
 2019-05-08 10:30:38 +01:00
g0tmi1k 8e1f1ae56a Close #294 - Add /weblogic/ready 2019-05-07 18:20:26 +01:00
g0tmi1k 011d276f2a Merge branch 'master' of github.com:danielmiessler/SecLists 2019-04-12 14:35:07 +01:00
g0tmi1k 7b1f14989c Quick move about 2019-04-12 13:52:47 +01:00
g0tmi1k 611ba969ec Move location 2019-04-10 13:31:17 +01:00
g0tmi1k 9e977458eb Add PHP Magic Hashes 
Source: https://www.whitehatsec.com/blog/magic-hashes/
 2019-04-10 13:29:50 +01:00
g0tmi1k 3f2c0d33d2 Quick clean up of locations 2019-04-10 13:22:39 +01:00
g0tmi1k 12751dbbf0 Fix #288 - Add graphql 
Source: https://graphql.org/learn/serving-over-http/
 2019-04-10 13:18:25 +01:00
g0tmi1k b9483d00b7 Sort out a few more filenmae issues 2019-04-10 11:32:07 +01:00
g0tmi1k 437478ce7b Fix #284 #285 - useragents-ie.txt 2019-04-10 10:19:12 +01:00
g0tmi1k 6d88c166fb Fix #226 - Remove 255+ file names 
but add in a  way to generate them
 2019-02-10 20:12:15 +00:00
g0tmi1k 758842d94f Fix #255 - Add more wps 2019-01-07 15:55:10 +00:00
g0tmi1k bd868067a6 Fix README - URLs and extra resources 2019-01-07 15:49:28 +00:00
g0tmi1k 5e1dc9cc79 Fix #259 - Recover from bad merge 2019-01-07 15:40:56 +00:00
g0tmi1k 4fb16b1ad3 Made OneSixtyOne happy with SNMP 
Source: https://github.com/trailofbits/onesixtyone/issues/1
 2018-12-11 11:22:26 +00:00
g0tmi1k b51d03d478 Add install information 2018-11-26 10:19:38 +00:00
g0tmi1k b99b0ed28f Added various User Agent strings 
Source: https://developers.whatismybrowser.com/useragents/explore/
 2018-11-26 09:56:22 +00:00
g0tmi1k 4c09aaf6c0 Add IP address header fields 
Source: https://stackoverflow.com/questions/1384410/php-getenvremote-addr-serious-side-effects
 2018-10-15 13:08:28 +01:00
g0tmi1k d68ba5f9ed Rename "_" -> "-" & found a few new homes 2018-10-15 13:08:10 +01:00
g0tmi1k d0d7aa5a60 Sort out README 2018-10-15 13:07:39 +01:00
g0tmi1k 9f73b7e81a Add LFISuite 
Source: https://github.com/D35m0nd142/LFISuite
 2018-07-25 13:51:06 +01:00
g0tmi1k 58f2b4db53 Improved on Filenames 
Source: https://twitter.com/h1_kenan/status/1016760864144285698

Source: https://www.google.com/?q=max+characters+filename+limit+linux
 2018-07-25 12:19:35 +01:00
g0tmi1k 201e2abfb5 Close #195 - Confluence administration 
Source: https://confluence.atlassian.com/doc/using-apache-to-limit-access-to-the-confluence-administration-interface-216433019.html
 2018-07-05 07:21:57 +01:00
g0tmi1k bc8b14dbb5 Fix for #201 - \_ -> _ 2018-07-05 07:19:39 +01:00
g0tmi1k efe58d6323 Quick move about 2018-06-19 07:59:56 +01:00
g0tmi1k 2faed8415e README clean up 2018-06-13 09:40:36 +01:00
g0tmi1k 8f27fd4cde Add Zip-Traversal Payload 2018-06-13 09:36:36 +01:00
g0tmi1k 3f79d071ce Quick move about 2018-03-21 17:47:29 +00:00
g0tmi1k 5278477235 Close #106 - XXE-Fuzzing / Grep PHP Auditing 2018-03-21 17:19:17 +00:00
g0tmi1k c524f768bf Close #148 - More Lotus Domino 
Source: https://github.com/danielmiessler/SecLists/issues/148
Source: https://github.com/rapid7/metasploit-framework/blob/6300758c46464ff5488bc49bc326ebbb1df46321/modules/auxiliary/scanner/lotus/lotus_domino_version.rb
Source: https://github.com/coldfusion39/domi-owned/blob/583d0a5ade9305c40329916e0ecf1540a089c9be/domi_owned/fingerprint.py#L60-L72
 2018-03-21 17:07:45 +00:00
g0tmi1k 2ff356ee2a Add domi-owned 
Source: https://github.com/coldfusion39/domi-owned
 2018-03-21 17:04:37 +00:00
g0tmi1k df9697d189 Add Domino-Hunter 
Source: https://sourceforge.net/projects/dominohunter/
 2018-03-21 16:59:57 +00:00
g0tmi1k 7a9a7c6c35 Close #135 - Default web roots (WIP!) 2018-03-21 16:50:02 +00:00
g0tmi1k 2b697209a8 Close #127 - Merge similar WebLogic files 
Command:
cat Weblogic.fuzz.txt weblogic.txt | sed -e 's/^\///' -e 's/ $//' | sort -u | sed -e 's/^/\//' > /tmp/weblogic.txt; mv {/tmp/,}weblogic.txt
cat Websphere.fuzz.txt websphere.txt | sed -e 's/^\///' -e 's/ $//' | sort -u | sed -e 's/^/\//' > /tmp/websphere.txt; mv {/tmp/,}websphere.txt
 2018-03-21 16:44:33 +00:00
g0tmi1k d17ff06a30 Close #96 - Add HTTP Request/Response headers 
Source: https://github.com/craSH/SecLists/commits/http-headers
 2018-03-21 16:34:56 +00:00
g0tmi1k 401af588f6 Close #88 - Fuzzing List Integer fields 
Source: https://github.com/arvinddoraiswamy/mywebappscripts/blob/master/FuzzLists/numeric_fields_only.txt
 2018-03-21 16:30:38 +00:00
g0tmi1k 7b6b792312 Close #69 - Fix SQLi Polyglot 
Source: https://labs.detectify.com/2013/05/29/the-ultimate-sql-injection-payload/

Source: https://twitter.com/SymbianSyMoh/status/707685783801454594
 2018-03-21 16:29:03 +00:00
g0tmi1k 9ae73c2ceb Add "Big List of Naughty Strings" 
Source: https://github.com/minimaxir/big-list-of-naughty-strings
 2018-03-21 16:20:10 +00:00
g0tmi1k bddd77825e Close #145 - Update Common_PHP_Filenames.txt (admin*.php) 2018-03-21 16:14:59 +00:00
g0tmi1k 0f7da0126e Close #147 - Add PHPSESSID in the list of session ids 2018-03-21 16:13:58 +00:00
g0tmi1k 26cf832f9d Close ##152 - PHP base64 filter file read (XXE_Fuzzing) 2018-03-21 16:13:09 +00:00
g0tmi1k 1863878864 Close #153 - Update ApacheTomcat.fuzz.txt 2018-03-21 16:10:27 +00:00
g0tmi1k 71d636f115 Close #164 - Include common default cloud users (Usernames) 2018-03-21 16:05:36 +00:00
g0tmi1k 1e13b9dc15 Close #177 - Update apache.txt (Add php.ini) 2018-03-21 16:03:59 +00:00
g0tmi1k b6163f2af6 Quick rename 2018-03-21 16:02:59 +00:00
g0tmi1k d2282eee97 Added ] in (Fix #131) 2018-03-07 11:46:03 +00:00
g0tmi1k 3c303a12e7 Removed leading spaces (Fix #137) 2018-03-07 11:45:26 +00:00
g0tmi1k 3043259a0a Removed domains & duplicates (Fix #138) 2018-03-07 11:42:24 +00:00
g0tmi1k 58fadb9d32 Removed duplicate lines (Start of fix: #138) 2018-03-07 11:15:09 +00:00
g0tmi1k 14318bd32b Fixed 10-million-password-list-top-1000000.txt with control character (Fix #139) 
Command: find . -type f -print -exec sh -c 'cat -v -n {} | grep "\^C4"' \;'
 2018-03-07 10:59:34 +00:00
g0tmi1k 9f965c5c84 Added 42.zip (Zip Bomb) (Fix #140) 
Source: http://www.unforgettable.dk/
 2018-03-07 10:44:20 +00:00
g0tmi1k 208d2e430d Added betterdefaultpasslist (Fix #143) 
Source: https://github.com/govolution/betterdefaultpasslist
 2018-03-07 10:42:27 +00:00
g0tmi1k cd38a43352 4 Digit PIN (Fix #169) 
Source: http://jemore.free.fr/wordpress/wp-content/pin_codes_sorted_by_frequency.zip
 2018-03-07 10:35:51 +00:00
g0tmi1k 4489327009 Worst Passwords 2017 - SpashData (Fix #173) 
Source: https://13639-presscdn-0-80-pagely.netdna-ssl.com/wp-content/uploads/2017/12/Top-100-Worst-Passwords-of-2017a.pdf
 2018-03-07 10:24:22 +00:00
g0tmi1k ec7a327edb Remove trace of 'merged.tar.gz' (Fix for #172) 2018-03-07 09:44:42 +00:00
g0tmi1k 7611257a60 Quick rename of files 2018-03-05 11:03:11 +00:00
g0tmi1k 934a28d094 Removed duplicate file 
`<N/A>,<N/A>,H4!b5at+kWls-8yh4Guq,Troll from: https://mostsecure.pw/`
 2018-03-05 10:31:42 +00:00
g0tmi1k 4f84b3c29b Renamed folders to be the 'full' names 2018-03-05 10:31:16 +00:00
g0tmi1k cb93d0d0b5 README.md clean up 2018-03-05 10:30:50 +00:00
g0tmi1k 08f12147a3 Add "-" to split up words, moved files since PR accepted 
- PRs: #122, #123, #125, #126, #136, #146, #149, #162, #174, #176
 2018-03-05 10:30:27 +00:00
g0tmi1k 47afcb61e2 Removed duplicate files 2018-03-05 10:04:37 +00:00
g0tmi1k f86d5b809d Add .gitignore file 2018-03-05 10:04:17 +00:00
g0tmi1k 7018c294f5 Set file permissions 2018-03-05 10:01:10 +00:00
g0tmi1k 307f703b8f Moved PHP webshell into its own folder 2018-03-05 10:00:51 +00:00
g0tmi1k 064eb40c33 Removed old rename file (no needed) 2018-03-05 10:00:21 +00:00
g0tmi1k 7a55e1871c Remove pointless files. 2018-03-05 09:52:00 +00:00
g0tmi1k 3ca04d1e6a Merge branch 'master' of https://github.com/danielmiessler/SecLists into structure 
# Conflicts:
#	Discovery/Web-Content/raft-large-words.txt
#	Miscellaneous/lang-english.txt
#	Miscellaneous/lang-german.txt
#	Miscellaneous/pi-large.txt
#	Passwords/CommonCreds/10-million-password-list-top-1000000.txt
#	Passwords/DefaultCreds/default-passwords.csv
#	Passwords/DefaultCreds/scada-pass.csv
#	Passwords/LeakedDB/000webhost.txt
#	Passwords/LeakedDB/Ashley-Madison.txt
#	Passwords/LeakedDB/alleged-gmail-passwords.txt
#	Passwords/LeakedDB/honeynet-withcount.txt
#	Passwords/LeakedDB/honeynet.txt
#	Passwords/LeakedDB/honeynet2.txt
#	Passwords/LeakedDB/md5decryptor.uk.txt
#	Passwords/LeakedDB/phpbb-nocount.txt
#	Passwords/LeakedDB/phpbb-withcount.txt
#	Passwords/LeakedDB/phpbb.txt
#	Passwords/LeakedDB/rockyou-withcount.txt.tar.gz
#	Passwords/LeakedDB/rockyou.txt.tar.gz
#	Passwords/Software/cain.txt
#	Passwords/openwall-all.txt
#	Web-Shells/FuzzDB/cmd-simple.php
#	Web-Shells/FuzzDB/cmd.aspx
#	Web-Shells/FuzzDB/cmd.jsp
#	Web-Shells/FuzzDB/list.jsp
#	Web-Shells/FuzzDB/reverse.jsp
#	Web-Shells/JSP/simple-shell.jsp
#	Web-Shells/laudanum-0.8/asp/dns.asp
#	Web-Shells/laudanum-0.8/asp/file.asp
#	Web-Shells/laudanum-0.8/asp/proxy.asp
#	Web-Shells/laudanum-0.8/asp/shell.asp
#	Web-Shells/laudanum-0.8/aspx/dns.aspx
#	Web-Shells/laudanum-0.8/aspx/file.aspx
#	Web-Shells/laudanum-0.8/aspx/shell.aspx
#	Web-Shells/laudanum-0.8/cfm/shell.cfm
#	Web-Shells/laudanum-0.8/jsp/warfiles/META-INF/MANIFEST.MF
#	Web-Shells/laudanum-0.8/jsp/warfiles/WEB-INF/web.xml
#	Web-Shells/laudanum-0.8/jsp/warfiles/cmd.jsp
 2017-12-20 16:46:49 +00:00