Wordlist-Generator generates wordlists with unique words with techniques mentioned in tomnomnom’s report “Who, What, Where, When”. It takes URLs from gau and splits them to get words in URLs.
Then it requests each URL to fetch all words. Finally, wordlist_generator removes from wordlist everything from “denylists” directory files to keep only unique words, which you can use for domain, directory, parameter, vhosts, etc bruteforcing.
Usage
$ ./wordlist_generator.py -d hackerone.com -a 5000 -t 50
$ ./wordlist_generator.py -d bugcrowd.com -a 1000
$ ./wordlist_generator.py -d intigriti.com > intigriti_wordlist.txt
To display the help for the tool use the -h flag:
./wordlist_generator.py -h
Flag | Description | Example |
---|---|---|
-domain | target domain | ./wordlist_generator.py -d openbugbounty.org |
-threads | threads amount | ./wordlist_generator.py -d yahoo.com -t 6 |
-amount | amount of URLs to fetch from gau | /wordlist_generator.py -d twitter.com -a 10000 |
Installation
$ git clone https://github.com/SomeKirill/wordlist_generator/
$ cd wordlist_generator
$ pip install requests
Denylists Wordlists Used
bomber is an application that scans SBOMs for security vulnerabilities. So you've asked a vendor…
Embed a payload within a PNG file by splitting the payload across multiple IDAT sections.…
Exploit-Street, where we dive into the ever-evolving world of cybersecurity with a focus on Local…
Shadow Dumper is a powerful tool used to dump LSASS (Local Security Authority Subsystem Service)…
shadow-rs is a Windows kernel rootkit written in Rust, demonstrating advanced techniques for kernel manipulation…
Extract and execute a PE embedded within a PNG file using an LNK file. The…