Merge branch 'master' into master

2026-08-12 16:57:40 +00:00 · 2024-11-26 10:16:54 -05:00
parent 2c9d844a3f 36e4d23164
commit 10dc5fe9d5
27 changed files with 2946479 additions and 76 deletions
@@ -580,6 +580,7 @@ wp-config-sample.php
 wp-config.php
 wp-config.php.stage
 wp-content/
+wp-content/debug.log
 wp-content/index.php
 wp-content/plugins/
 wp-content/plugins/akismet/
@@ -164,6 +164,7 @@ system/
 system_web/
 test/
 tools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=goatfart+samples+from+microsoft&dbq=..%2F..%2Fwwwroot%2goatfart.html&newdb=CREA
+trace.axd
 tsweb/
 vc30
 _fpclass/
@@ -187,9 +188,11 @@ _vti_pvt/authors.pwd
 _vti_pvt/service.pwd
 _vti_pvt/shtml.exe
 _vti_pvt/users.pwd
+_vti_inf.html
 _vti_script
 _vti_txt
 web/
+web.config
 _WEB_INF/
 WEB-INF/web.xml
 WebSer~1
@@ -208,4 +211,4 @@ x.shtml
 con/
 aux/
 con.aspx
-aux.aspx
+aux.aspx
@@ -2,11 +2,8 @@

 ## combined_words.txt

-Use for: discovering files    
-This list is automatically updated by a github action whenever any of the lists it's composed by is modified.
-
+### Overview
 This list is a combination of the following wordlists:
-
 - big.txt
 - common.txt
 - raft-large-words-lowercase.txt
@@ -16,12 +13,15 @@ This list is a combination of the following wordlists:
 - raft-small-words-lowercase.txt
 - raft-small-words.txt

+### Usage
+Use for: discovering files
+
+### Source
+This list is automatically updated by a GitHub action whenever any of the lists it's composed by is modified.

 ## combined_directories.txt

-Use for: discovering files and directories    
-This list is automatically updated by a github action whenever any of the lists it's composed by is modified.
-
+### Overview
 This list is a combination of the following wordlists:
 - apache.txt
 - combined_words.txt
@@ -35,21 +35,36 @@ This list is a combination of the following wordlists:
 - raft-medium-directories.txt
 - raft-small-directories-lowercase.txt
 - raft-small-directories.txt
+- common_directories.txt
+
+### Usage
+Use for: discovering files and directories
+
+### Source
+This list is automatically updated by a GitHub action whenever any of the lists it's composed by is modified.

 ## dsstorewordlist.txt

-SOURCE: https://github.com/aels/subdirectories-discover
-
+### Overview
 Perfect wordlist to discover directories and files on target site with tools like ffuf.
+
+### Usage
+Use for: discovering directories and files
+
+### Source
+Source: https://github.com/aels/subdirectories-discover
+
+### References
 - It was collected by parsing Alexa top-million sites for **.DS_Store** files (https://en.wikipedia.org/wiki/.DS_Store), extracting all the found files, and then extracting found file and directory names from around 300k real websites.
 - Then sorted by probability and removed strings with one occurrence.
 - resulted file you can download is below. Happy Hunting!

 ## vulnerability-scan_j2ee-websites_WEB-INF.txt
+
+### Overview
 Use for: discovering sensitive j2ee files exploiting a lfi

-References: 
-    
+### References
 - https://gist.github.com/harisec/519dc6b45c6b594908c37d9ac19edbc3
 - https://github.com/projectdiscovery/nuclei-templates/blob/master/vulnerabilities/generic/generic-j2ee-lfi.yaml
 - https://github.com/ilmila/J2EEScan/blob/master/src/main/java/burp/j2ee/issues/impl/LFIModule.java
@@ -1 +1,55 @@
-The URLs directory will hold numerous lists of URLs for common systems that one may attack, e.g. WordPress, Drupal, etc. These lists can be passed through an intercepting proxy in order to populate a site tree with whitebox-like knowledge.
+# URLs Wordlist
+
+A wordlist of URLs for common systems that one may attack, e.g. WordPress, Drupal, etc.
+
+## urls-Drupal-7.20.txt
+
+### Overview
+This file contains URLs for Drupal 7.20.
+
+### Usage
+Use for: populating a site tree with whitebox-like knowledge
+
+### Source
+Source: Collected from various sources
+
+## urls-joomla-3.0.3.txt
+
+### Overview
+This file contains URLs for Joomla 3.0.3.
+
+### Usage
+Use for: populating a site tree with whitebox-like knowledge
+
+### Source
+Source: Collected from various sources
+
+## urls-SAP.txt
+
+### Overview
+This file contains URLs for SAP.
+
+### Usage
+Use for: populating a site tree with whitebox-like knowledge
+
+### Source
+Source: Collected from various sources
+
+## urls-wordpress-3.3.1.txt
+
+### Overview
+This file contains URLs for WordPress 3.3.1.
+
+### Usage
+Use for: populating a site tree with whitebox-like knowledge
+
+### Source
+Source: Collected from various sources
+
+## Usage Instructions
+
+1. Download the desired URL wordlist file.
+2. Use an intercepting proxy (e.g., Burp Suite) to pass the URLs through and populate a site tree with whitebox-like knowledge.
+3. Analyze the site tree to identify potential vulnerabilities and attack vectors.
+
+
@@ -1,24 +1,105 @@
-# api_wordlist
+# API Wordlist
+
 A wordlist of API names used for fuzzing web application APIs.

-## Contents
-* api_seen_in_wild.txt - This contains API function names I've seen in the wild.
-* actions.txt - All API function name verbs
-* objects.txt - All API function name nouns
-* actions-uppercase.txt - API function name verbs with leading character upper-case
-* actions-lowercase.txt - API function name verbs with leading character lower-case
-* objects-uppercase.txt - API function name nouns with leading character upper-case
-* objects-lowercase.txt - API function name nouns with leading character lower-case
-* api-endpoints-res.txt - Combination of all of the files above
+## api_seen_in_wild.txt

-## Usage
- 1. In burpsuite, send an API request you want to fuzz to Intruder. 
- 2. Remove the existing API function call, and replace it with two § characters for each text file you want to use.
- 3. On the "Positions" tab, set Attack type to "Cluster Bomb".
- 4. On the "Payloads" tab, select 1 for the fist Payload set drop-down, then select a Payload type of "Runtime file" and navigate to the directory you downloaded these text files to. Select "actions.txt".
- 5. Repeat step 4 by setting Payload set 2 to "objects.txt".
- 6. (optional step - add more payload sets and set them to "objects.txt" to test for multi-part objects like "UserAccount")
- 7. Start attack!
+### Overview
+This file contains API function names that have been observed in the wild.
+
+### Usage
+Use for: fuzzing web application APIs
+
+### Source
+Source: Collected from various sources
+
+## actions.txt
+
+### Overview
+This file contains all API function name verbs.
+
+### Usage
+Use for: fuzzing web application APIs
+
+### Source
+Source: Collected from various sources
+
+## objects.txt
+
+### Overview
+This file contains all API function name nouns.
+
+### Usage
+Use for: fuzzing web application APIs
+
+### Source
+Source: Collected from various sources
+
+## actions-uppercase.txt
+
+### Overview
+This file contains API function name verbs with the leading character in upper-case.
+
+### Usage
+Use for: fuzzing web application APIs
+
+### Source
+Source: Collected from various sources
+
+## actions-lowercase.txt
+
+### Overview
+This file contains API function name verbs with the leading character in lower-case.
+
+### Usage
+Use for: fuzzing web application APIs
+
+### Source
+Source: Collected from various sources
+
+## objects-uppercase.txt
+
+### Overview
+This file contains API function name nouns with the leading character in upper-case.
+
+### Usage
+Use for: fuzzing web application APIs
+
+### Source
+Source: Collected from various sources
+
+## objects-lowercase.txt
+
+### Overview
+This file contains API function name nouns with the leading character in lower-case.
+
+### Usage
+Use for: fuzzing web application APIs
+
+### Source
+Source: Collected from various sources
+
+## api-endpoints-res.txt
+
+### Overview
+This file is a combination of all the files above.
+
+### Usage
+Use for: fuzzing web application APIs
+
+### Source
+Source: Collected from various sources
+
+## Usage Instructions
+
+1. In Burp Suite, send an API request you want to fuzz to Intruder.
+2. Remove the existing API function call, and replace it with two § characters for each text file you want to use.
+3. On the "Positions" tab, set Attack type to "Cluster Bomb".
+4. On the "Payloads" tab, select 1 for the first Payload set drop-down, then select a Payload type of "Runtime file" and navigate to the directory you downloaded these text files to. Select "actions.txt".
+5. Repeat step 4 by setting Payload set 2 to "objects.txt".
+6. (Optional step - add more payload sets and set them to "objects.txt" to test for multi-part objects like "UserAccount")
+7. Start the attack!

 ## Comments
+
 If you use this and it's helpful, I'd love to hear about it! (@dagorim). If you think I've missed any obvious word choices, I'd love to hear about that as well, or feel free to add them.
@@ -1086,6 +1086,7 @@ __admin
 __backup
 __data
 __errfiles__
+__better_errors
 __g
 __include
 __includes
@@ -11066,6 +11067,7 @@ loginadmin
 loginerror
 loginflat
 loginimages
+loginURL
 logins
 logis
 logistics
@@ -9894,6 +9894,7 @@ web_store
 xxpafaq
 ]
 __errfiles__
+__better_errors
 ___test
 _art
 _artperpage
@@ -19428,6 +19428,7 @@ xeabdbfddaccx
 _2
 _excel
 __errfiles__
+__better_errors
 _api
 _calendar
 _control
@@ -3527,6 +3527,7 @@ reports
 reports list
 repository
 repost
+reportserver
 reprints
 reputation
 req
@@ -0,0 +1,4 @@
+gift-card
+insurance_applications
+shrdbms
+top-categories
@@ -1,13 +1,21 @@
 .asp
+.ascx
+.ashx
+.asmx
 .aspx
+.axd
 .bat
 .c
 .cfm
 .cgi
+.class
+.crt
 .css
+.csv
 .com
 .dll
 .exe
+.flv
 .hta
 .htm
 .html
@@ -27,6 +35,7 @@
 .php5
 .php6
 .php7
+.php8
 .phps
 .pht
 .phtml
@@ -54,12 +63,12 @@
 .ogv
 .oga
 .webm
+.webp
 .json
 .md
 .markdown
 .rss
 .atom
-
 .asp
 .asP
 .aSp
@@ -4351,6 +4360,8 @@
 .webm.markdown
 .webm.rss
 .webm.atom
+.yaml
+.yml
 .json.asp
 .json.aspx
 .json.bat
@@ -66871,4 +66882,4 @@
 .atom.rss.
 ..atom.rss
 .atom.rss…
-….atom.rss
+….atom.rss
@@ -15,6 +15,7 @@
 .jhtml
 .js
 .jsa
+.json
 .jsp
 .log
 .mdb
@@ -32,6 +33,7 @@
 .phtml
 .pl
 .phar
+.rb
 .reg
 .sh
 .shtml