Commit Graph
100 Commits
Author SHA1 Message Date
g0tmi1kandGitHub 461a11a7f2 Merge pull request #368 from bkimminich/master
Add list of dangerous Angular/AngularJS functions

Source: https://angular.io/guide/security
2019-11-07 22:44:24 +00:00
g0tmi1kandGitHub a627b78566 Update README.md 2019-11-03 11:04:57 +00:00
g0tmi1kandGitHub 5da5dacb23 Merge pull request #366 from davidegirardi/master
Add CICS transaction list

Source: https://www.ibm.com/support/knowledgecenter/SSGMCP_5.4.0/reference/transactions/dfha726.html
2019-11-03 11:03:51 +00:00
g0tmi1kandGitHub af721716c1 Merge pull request #365 from wasamasa/fix-jsp-web-shell
Fix JSP webshell syntax errors
2019-10-22 22:01:27 +01:00
g0tmi1kandGitHub 93e2c5b064 Merge pull request #364 from righettod/master
Add local ports for local services discovery
2019-10-21 16:53:24 +01:00
g0tmi1kandGitHub 6b405ea8d8 Merge pull request #363 from oh6hay/master
51k random creds obtained by running Heralding for two weeks in Sep/2019
2019-10-21 10:23:05 +01:00
g0tmi1kandGitHub 97ea172c1e Merge pull request #362 from tkisason/patch-3
adds jolokia

Source: https://jolokia.org
2019-10-13 22:19:08 +01:00
g0tmi1kandGitHub b8a8cc5a44 Merge pull request #361 from righettod/master
Add dictionary for GraphQL

Source: https://graphql.org/
2019-10-11 17:19:21 +01:00
g0tmi1kandGitHub 06d29fa2b0 Merge pull request #360 from righettod/master
Add VIM and NANO backup file
2019-10-11 15:59:03 +01:00
g0tmi1kandGitHub 6fae58fa9b Merge pull request #357 from govolution/patch-3
Update ssh-betterdefaultpasslist.txt

https://github.com/SamuraiWTF/samuraiwtf
http://docs.graylog.org/en/2.4/pages/installation/virtual_machine_appliances.html
https://openvpn.net/vpn-server-resources/deploying-the-access-server-appliance-on-vmware-esxi/
https://www.circl.lu/services/misp-training-materials/
https://documentation.wazuh.com/3.10/installation-guide/virtual-machine.html
https://my.nps.edu/web/c3o/virtual-machine-images
https://virtualboxes.org/images/centos/
2019-10-10 12:13:29 +01:00
g0tmi1kandGitHub 8e42ce0a0e Merge pull request #358 from govolution/patch-4
Update windows-betterdefaultpasslist.txt

Source: https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
2019-10-10 12:13:11 +01:00
g0tmi1kandGitHub 2dcab37f3e Merge pull request #359 from govolution/patch-5
Update mssql-betterdefaultpasslist.txt

Source: https://github.com/fgrehm/vagrant-mssql-express
2019-10-10 12:12:42 +01:00
g0tmi1kandGitHub 7c4ef6f4dd Merge pull request #355 from XalfiE/master
Addition of Oracle EBS default users, passwords and URLs

Source: https://the-infosec.com/2017/03/29/do-you-know-what-your-erp-is-telling-us/
2019-10-07 11:28:32 +01:00
g0tmi1kandGitHub 6adcec0fda Merge pull request #354 from stuntguy3000/patch-1
Fix Fuzzing Types (Fixes #339)
2019-10-04 16:39:46 +01:00
g0tmi1kandGitHub 8ebc73f1c1 Merge pull request #353 from tkisason/patch-2
adds mappings and restart
2019-10-03 09:34:33 +01:00
g0tmi1kandGitHub 785983aa9c Merge pull request #352 from drwetter/patch-3
Update with entries from Wikipedia

Source: https://en.wikipedia.org/wiki/List_of_/.well-known/_services_offered_by_webservers
2019-10-02 20:37:23 +01:00
g0tmi1kandGitHub 5b82c421bc Merge pull request #351 from bl00dh0und/dutchwordlist
Added dutchwordlist

Source:

- https://www.digitalpulse.pwc.com.au/infographic-password-security-psychology/
- https://www.vernoeming.nl/populair/meisjesnamen-2014
- https://www.vernoeming.nl/populair/jongensnamen-2014
- https://www.dierennamen.net/kattennamen-op-alfabetische-volgorde/
2019-10-01 12:19:58 +01:00
g0tmi1kandGitHub 1e7aca5b3b Merge pull request #350 from drwetter/patch-2
Update CONTRIBUTORS.md
2019-09-30 16:09:03 +01:00
g0tmi1kandGitHub 5eaa8b2cec Merge pull request #349 from drwetter/patch-2
Add some .well-known dir entries

https://developer.apple.com/library/archive/documentation/General/Conceptual/AppSearch/UniversalLinks.html

https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml
2019-09-30 15:53:06 +01:00
g0tmi1kandGitHub 519a72ae39 Merge pull request #342 from dotan3/master
Add Laravel related urls to quickhits.txt

Source: https://laravel.com/docs/6.x
2019-09-30 10:48:05 +01:00
g0tmi1kandGitHub 7148816422 Merge branch 'master' into master 2019-09-30 10:47:53 +01:00
g0tmi1kandGitHub 692e7c0038 Merge pull request #341 from NeuronAddict/html-colors
Add html color

Source: https://www.w3schools.com/colors/colors_names.asp
2019-09-30 10:46:16 +01:00
g0tmi1kandGitHub ed0e6e1e1e Merge pull request #343 from draguntsow/patch-1
Create a wordlist of Modx Revolution CMS packages

Source: https://modx.com/
2019-09-30 10:44:43 +01:00
g0tmi1kandGitHub 352782af09 Merge pull request #346 from ngkogkos/patch-1
Update with missing common endpoints

Source: https://twitter.com/NahamSec/status/1177672652011343873
2019-09-30 10:37:56 +01:00
g0tmi1kandGitHub a0f31b5a9d Merge pull request #337 from ericrange/patch-3
New Default Password List

Source: http://phenoelit.org/dpl/dpl.html.

```
<username>:<password>
<username>: => no password
<>:<> => no user nor password at all
```
2019-08-23 16:00:48 +01:00
g0tmi1kandGitHub a2505448b9 Merge pull request #336 from ericrange/patch-2
Remove admin:password
2019-08-20 09:57:31 +01:00
g0tmi1kandGitHub da5c0c015c Merge pull request #335 from g0tmi1k/misc
Add more zip-bombs

Source: https://www.bamsoftware.com/hacks/zipbomb/
2019-08-18 11:35:37 +01:00
g0tmi1kandGitHub 21ed415275 Merge pull request #334 from hisxo/patch-2
Added new files path

Source: https://github.com/hisxo/Wordlist/blob/master/symfony.txt
2019-08-18 11:21:07 +01:00
g0tmi1kandGitHub 2dd253e2db Merge pull request #333 from g0tmi1k/misc
Close #329 - Bo0oM's fuzz.txt

Source: https://github.com/Bo0oM/fuzz.txt
2019-08-13 04:51:10 -07:00
g0tmi1kandGitHub f02a0ae9bb Merge pull request #332 from g0tmi1k/misc
Misc
2019-08-13 04:45:36 -07:00
g0tmi1kandGitHub b3a47230fd Merge pull request #323 from clem9669/patch-2
Rename lang-french.txt to lang-french-full.txt

```
https://www.pallier.org/liste-de-mots-francais.html (website for download)
http://www.fifi.org/doc/ifrench-gut/fr/reference.pdf.gz (paper for the french dictionary generation)

The downloadable https://www.pallier.org/extra/liste.de.mots.francais.frgut.txt is a liste de 336531 mots du français (encodés en utf-8).
```
2019-08-13 04:44:00 -07:00
g0tmi1kandGitHub 56cea5a646 Merge pull request #322 from clem9669/patch-1
Delete lang-french.txt
2019-08-13 04:43:28 -07:00
g0tmi1kandGitHub 162c2ee368 Merge pull request #328 from hisxo/patch-1
Create symfony wordlist (for LFI/Path Traversal)

Source: https://github.com/hisxo/wordlist
2019-08-13 04:36:15 -07:00
g0tmi1kandGitHub fd95031f64 Merge pull request #330 from denzuko/patch-2
Create stupid-ones-in-production.txt
2019-08-13 04:35:59 -07:00
g0tmi1kandGitHub aeeac3d7ef Merge pull request #331 from ericrange/patch-2
new config file locations
2019-08-13 04:35:31 -07:00
g0tmi1kandGitHub 1f6c4c10bf Merge pull request #326 from toxydose/patch-1
add Dot CMS login endpoint

Source: https://dotcms.com/docs/latest/logging-into-dotcms
2019-07-29 14:42:12 +01:00
g0tmi1kandGitHub 3c3fc7c89e Merge pull request #325 from toxydose/patch-2
add weevely.php shell endpoint

Source: https://tools.kali.org/maintaining-access/weevely
2019-07-26 13:57:15 +01:00
g0tmi1kandGitHub d99ade3d0c Merge pull request #324 from Glassware123/patch-1
Update vnc-betterdefaultpasslist.txt
2019-07-26 12:32:38 +01:00
g0tmi1kandGitHub 3019f92124 Merge pull request #321 from toxydose/patch-1
add /phpmyadmin/ endpoints
2019-07-21 08:42:05 +01:00
g0tmi1kandGitHub 40eeff6fc5 Merge pull request #318 from mbiert/readme-git-path
Fix git clone complete path
2019-07-12 11:40:07 +01:00
g0tmi1kandGitHub fab1f77a7d Merge pull request #317 from maxence-schmitt/patch-1
Adding sha256 magic hash

Source: https://github.com/spaze/hashes/blob/master/README.md
2019-07-11 14:48:53 +01:00
g0tmi1kandGitHub f0438d39e3 Merge pull request #316 from g0tmi1k/misc
Close #154 - 1.4 billion password breach compilation wordlist
2019-07-09 12:15:50 +01:00
g0tmi1kandGitHub 503c57f500 Merge pull request #314 from jakobhuss/patch-1
Non valid ipv4
2019-07-05 17:22:13 +01:00
g0tmi1kandGitHub c94bdb754c Merge pull request #315 from toxydose/master
Created Sitecore CMS wordlist + minor endpoint updates.

Sitecore CMS:  https://www.sitecore.com/

Sensitive endpoints: https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/deny-anonymous-users-access-to-a-folder.html

Sitecore docs:  
https://doc.sitecore.com/legacy-docs/SC72/sitecore-web-service-sc65-a4.pdf
https://doc.sitecore.com/SdnArchive/upload/sitecore7/75/sitecore_security_hardening_guide-sc75-usletter.pdf

Contains sensitive info
https://zellwk.com/blog/bower/
2019-07-05 17:20:28 +01:00
g0tmi1kandGitHub c9a56c3fe0 Merge pull request #312 from g0tmi1k/richelieu
Add richelieu
2019-07-03 14:11:25 +01:00
g0tmi1kandGitHub e06b13d36d Merge pull request #310 from waawaa/patch-1
Missing paths with known RCE vulnerabilities

- https://www.exploit-db.com/exploits/46814
- https://www.exploit-db.com/exploits/43458
- https://paper.seebug.org/910/
- https://techblog.mediaservice.net/2018/07/cve-2017-10271-oracle-weblogic-server-remote-command-execution-sleep-detection-payload/
2019-07-02 14:16:55 +01:00
g0tmi1kandGitHub b0cbe86a20 Merge pull request #306 from g0tmi1k/phpinfo
Add a few more filenames

Based on https://anotherhackerblog.com/exploiting-file-uploads-pt1/
2019-06-07 11:07:47 +01:00
g0tmi1kandGitHub b5de230180 Merge pull request #305 from g0tmi1k/guardicore
Add MSSQL from guardicore: labs_campaigns-Nansh0u

Source: https://github.com/guardicore/labs_campaigns/blob/master/Nansh0u/common_passwords.txt
Source: https://github.com/guardicore/labs_campaigns/blob/master/Nansh0u/common_usernames.txt
2019-05-30 12:24:56 +01:00
g0tmi1kandGitHub 28db64c6e2 Merge pull request #304 from g0tmi1k/xss
Add XSS without parentheses and semi-colons

Source: https://portswigger.net/blog/xss-without-parentheses-and-semi-colons
2019-05-22 12:18:18 +01:00
g0tmi1kandGitHub a176d0ccff Merge pull request #301 from g0tmi1k/Fixes
Give credit where its due!
2019-05-08 15:35:25 +01:00
g0tmi1kandGitHub 379fba7854 Merge pull request #300 from g0tmi1k/Fixes
Better filenames
2019-05-08 12:30:24 +01:00
g0tmi1kandGitHub 37fce3b2c1 Merge pull request #299 from g0tmi1k/Fixes
Source: https://github.com/chrislockard/api_wordlist
2019-05-08 12:22:50 +01:00
g0tmi1kandGitHub bb915befb2 Merge pull request #298 from g0tmi1k/Fixes
Close #291 - Fix encoding issues

```
$ for x in $( find . -type f ); do iconv -f utf-8 -t utf-8 -c ${x} | sed '/^$/d' > tmp; mv tmp ${x}; done
```
2019-05-08 11:08:05 +01:00
g0tmi1kandGitHub 3c8ddaf468 Merge pull request #297 from g0tmi1k/Fixes
Close #293 - Ten Million Passwords

Source: https://xato.net/today-i-am-releasing-ten-million-passwords-b6278bbe7495

https://wpengine.com/unmasked/

https://mega.nz/#!SdYnkJRJ!HmD04LH8Gk8JtlNG6O2NnF2yH9qWJPWtSXbLU2ZR9Q8


```
$ awk -F '\t' '{print $1}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-usernames.txt
$ awk -F '\t' '{print $2}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-passwords.txt
$ awk -F '\t' '{print $1}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | grep -v ' 1 ' | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-usernames-dup.txt
$ awk -F '\t' '{print $2}' 10-million-combos.txt | LC_ALL=C sort | LC_ALL=C uniq -c | LC_ALL=C sort -nr | grep -v ' 1 ' | awk -F ' ' '{for (i=2; i<=NF; i++) print $i}' > xato-net-10-million-passwords-dup.txt
```
2019-05-08 10:33:10 +01:00
g0tmi1kandGitHub 004af903c4 Merge pull request #296 from g0tmi1k/Fixes
Close #294 - Add /weblogic/ready
2019-05-07 18:20:50 +01:00
g0tmi1kandGitHub 9e5f97fac5 Merge pull request #292 from Beverdam/master
Added NCSC top 100K most used passwords

Source: https://www.ncsc.gov.uk/static-assets/documents/PwnedPasswordTop100k.txt
https://www.ncsc.gov.uk/blog-post/passwords-passwords-everywhere
2019-05-07 17:49:26 +01:00
g0tmi1kandGitHub 181bd743eb Merge pull request #290 from ricardojba/master
Include .well-known/apple-app-site-association

Source: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/april/apples_app_site_association_the_new_robots_txt/
2019-04-12 16:31:18 +01:00
g0tmi1kandGitHub 7ccb85c376 Merge pull request #289 from toxydose/master
minor updates
2019-04-10 14:16:40 +01:00
g0tmi1kandGitHub aca3a1bb5c Merge pull request #286 from bkimminich/master
Add worlds-safest-password list by Der Postillon

Source: https://www.der-postillon.com/2014/04/it-experten-kuren-mb2r5ohf-0t-zum.html
2019-04-05 08:35:35 +01:00
g0tmi1kandGitHub ed69bd3738 Merge pull request #282 from drwetter/master
Suggestion to avoid license files to be added per accident
2019-03-19 09:30:26 +00:00
g0tmi1kandGitHub bca680eef5 Merge pull request #281 from Zawadidone/patch-1
Update IIS.fuzz.txt

Source: https://twitter.com/mrr0y4l3/status/1106602488495525888?s=12
2019-03-18 19:17:26 +00:00
g0tmi1kandGitHub 067e5cfc01 Merge pull request #280 from drwetter/master
Adding more springboot entrypoints

Source: https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#production-ready-endpoints
2019-03-17 11:30:53 +00:00
g0tmi1kandGitHub 6830bbe052 Merge pull request #278 from tkisason/patch-1
Update spring-boot.txt

Source: https://www.veracode.com/blog/research/exploiting-spring-boot-actuators
2019-03-16 20:31:21 +00:00
g0tmi1kandGitHub 75ea478e81 Merge pull request #279 from ArgentEnergy/new-web-paths
New web paths
2019-03-16 11:37:57 +00:00
g0tmi1kandGitHub ca946eefff Merge pull request #277 from noraj/patch-2
simple-shell.jsp: fix file
2019-03-11 16:59:45 +00:00
g0tmi1kandGitHub 9196a19470 Merge pull request #274 from noraj/patch-1
Update LFI-JHADDIX.txt
2019-03-11 07:12:44 +00:00
g0tmi1kandGitHub 8087c4ba5d Merge pull request #273 from leesoh/master
Add "admin"
2019-02-23 08:17:14 +00:00
g0tmi1kandGitHub 73a4b826e8 Merge pull request #272 from govolution/patch-1
Update vagrant credentials

Source: https://app.vagrantup.com/peru/boxes/windows-10-enterprise-x64-eval
2019-02-21 14:46:43 +00:00
g0tmi1kandGitHub 70958f58b6 Merge pull request #271 from SolomonSklash/patch-1
Fixed typo in file name.
2019-02-20 10:06:14 +00:00
g0tmi1kandGitHub 5704666b23 Merge pull request #270 from g0tmi1k/fix-226
Fix #226 - Remove 255+ file names
2019-02-10 20:13:48 +00:00
g0tmi1kandGitHub 56d8922757 Merge pull request #269 from 0xInfection/patch-1
A wrong payload corrected
2019-02-10 19:37:49 +00:00
g0tmi1kandGitHub 069c301733 Merge pull request #268 from xpirt/patch-1
add /admin-console directory
2019-02-08 16:17:28 +00:00
g0tmi1kandGitHub 72d9141eb4 Update secretkeywords.txt
As requested ~ https://github.com/danielmiessler/SecLists/pull/267#issuecomment-458900997
2019-01-30 11:12:02 +00:00
g0tmi1kandGitHub a0c2048867 Merge pull request #267 from nsonaniya2010/master
new secret keywords added

Source: https://github.com/nsonaniya2010/SubDomainizer/blob/55899c0ee0769a521f49edaf88da97a0f951e4b5/SubDomainizer.py#L174
2019-01-30 10:52:00 +00:00
g0tmi1kandGitHub 63396f101c Merge pull request #266 from theguly/master
guly: added shubs lists

Source:
- https://raw.githubusercontent.com/assetnote/commonspeak2-wordlists/master/subdomains/subdomains.txt
- https://raw.githubusercontent.com/pentester-io/commonspeak/master/stackoverflow/output/compiled/stackoverflow_2017_10_22.urls_subdomains.txt
2019-01-30 10:28:52 +00:00
g0tmi1kandGitHub 4264cf5ffd Merge pull request #265 from speedinternet/smfixes
removes exec. bits
2019-01-27 20:36:06 +00:00
g0tmi1kandGitHub 838ada9e20 Merge pull request #263 from IndiNijhof/patch-1
Update ftp-betterdefaultpasslist.txt
2019-01-27 09:13:16 +00:00
g0tmi1kandGitHub 7ed3f897df Merge pull request #237 from s0md3v/patch-1
+5 payloads, some enhancements
2019-01-08 18:11:33 +00:00
g0tmi1kandGitHub a012b65235 Typo 2019-01-07 15:58:27 +00:00
g0tmi1kandGitHub 8f3802fd51 Merge pull request #262 from g0tmi1k/websphere
Fix #255 - Add more wps
2019-01-07 15:55:58 +00:00
g0tmi1kandGitHub 470bb32840 Merge pull request #256 from Prinzhorn/LFI-LFISuite-pathtotest-huge
Strip HTML from LFI-LFISuite-pathtotest-huge.txt
2019-01-07 15:50:48 +00:00
g0tmi1kandGitHub ddb1eb2ccb Merge pull request #258 from henry701/patch-1
Fix row collumn quantity to 4
2019-01-07 15:50:20 +00:00
g0tmi1kandGitHub 8103bbddb8 Merge pull request #261 from g0tmi1k/readme
Fix README - URLs and extra resources
2019-01-07 15:50:06 +00:00
g0tmi1kandGitHub d19c482b75 Merge pull request #260 from g0tmi1k/recover
Fix #259 - Recover from bad merge
2019-01-07 15:41:59 +00:00
g0tmi1kandGitHub f9c1ec678c Merge pull request #253 from toxydose/master
Merge and delete vordlists, add login.html to Logins.fuzz.txt
2018-12-11 11:33:42 +00:00
g0tmi1kandGitHub 3e30797df9 Merge pull request #254 from g0tmi1k/snmp
Made OneSixtyOne happy with SNMP
2018-12-11 11:25:22 +00:00
g0tmi1kandGitHub 692a3a3cb9 Merge pull request #252 from Natfan/patch-1
Updated this file to be a real CSV file.
2018-12-11 11:24:55 +00:00
g0tmi1kandGitHub cdf9fce969 Merge pull request #251 from chokeee/patch-1
Update README.md
2018-12-09 09:48:53 +00:00
g0tmi1kandGitHub a28f62c52e Merge pull request #250 from francisuk1989/patch-1
dietpi

Source: https://dietpi.com/#download
2018-12-09 09:48:37 +00:00
g0tmi1kandGitHub 3afd36dd5c Merge pull request #249 from toxydose/master
Removed duplicates, merged files in /Discovery/Web-Content/
2018-12-08 15:56:24 +00:00
g0tmi1kandGitHub 719bdb02a2 Merge pull request #248 from toxydose/master
merged two coldfusion.fuzz files and deleted duplicates
2018-12-07 14:33:08 +00:00
g0tmi1kandGitHub f17d80a8fb Merge pull request #247 from toxydose/master
add Atlassian Confluence login endpoints

Source: https://confluence.atlassian.com/doc/customizing-the-login-page-163938553.html
2018-12-06 09:25:19 +00:00
g0tmi1kandGitHub cbf2229610 Merge pull request #246 from nsonaniya2010/secretKeywords
List Addition - A list of secret related keywords should be added
2018-12-03 10:12:21 +00:00
g0tmi1kandGitHub da5d8c8125 Merge pull request #243 from toxydose/master
some additions and editions
2018-12-02 07:46:22 +00:00
g0tmi1kandGitHub b8da13eb6e Update README.md 2018-11-26 10:20:38 +00:00
g0tmi1kandGitHub 691bc9bd72 Merge pull request #242 from g0tmi1k/misc
Add install information
2018-11-26 10:19:59 +00:00
g0tmi1kandGitHub 47b1829910 Merge pull request #241 from g0tmi1k/ua
Added various User Agent strings
2018-11-26 10:09:44 +00:00
g0tmi1kandGitHub 75ebcd1e1f Merge pull request #240 from vinnytroia/1m_domains
Added top 1m Alexa domains 

Source: https://www.alexa.com/topsites
2018-11-23 10:01:54 +00:00
g0tmi1kandGitHub ea79b4facb Merge pull request #239 from tomcodes/master
Add sonar-project.properties and default HashiChorp Vault url to quickhits.txt

Source: https://docs.sonarqube.org/display/SCAN/Analyzing+with+SonarQube+Scanner
2018-11-21 15:16:08 +00:00
g0tmi1kandGitHub 933f1d5fba Merge pull request #238 from tomcodes/master
Add AWS CodeDeploy appspec.yml file to quickhits.txt

Source: https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file.html
2018-11-21 14:42:13 +00:00