[]("Word Lists, Attack Strings, Miscellaneous Datasets and a PoC Wiki for Penetration Testing")

This project consists of word lists, dictionary files, attack strings, miscellaneous datasets and a PoC wiki for penetration testers

This project is a collection of word lists--they are mostly whitespace-delimited or line-based. Although the passes-dicts folder contains inputs for password cracking, overall the files amassed here are intended to be useful in facilitating the creation of insecure program state (with the help of a black-box fuzzer or scanning utility, for example.) The vast majority of files are simply ASCII with the UNIX style newline.

If you're already familiar with established repositories such as fuzzdb and SecLists, then werdlists is quite similar in mission as it's a centralized attack strings and input data resource with its own unique style, organization, original hand-crafted contents, verification/management scripts, expanded concepts, etc. SecLists is maintained by my colleague and co-worker at IOActive, Daniel Miessler.

The scripts folder consists of shell scripts used for repository maintenance. All scripts use bash syntax and some data files were generated with a script. Folder names are outlined in the INDEX.md file in the repository's root directory. All files in each folder are detailed in the local README.md file, but these lowercased index files describe the contents of each data file, as opposed to directory contents. Each folder has a subject name and storage type which are separated by a dash.

Most files have the *.txt extension signifying the text/plain MIME type Other file extensions in use are: *.asc, *.csv, *.xml, *.html, and *.yml These are for Comma-Separated Values (text/csv), Extended Markup Language (application/xml), Hyper Text Markup Language (application/html), etc. Any file that is larger than 1MB uncompressed should be compressed with xz according to the commands in the scripts/compress-large-files bash script. In spite of the fact that this is a word lists project, I'm striving to restrict the size of each file to a healthy maximum for manageability purposes. The index file in the root folder (INDEX.md), as well as the indices in each data directory (README.md) are formatted with GitHub Flavored Markdown.

arpa-headers: 📧 Header fields transmitted over RFC2822 style protocols like SMTP
ascii-art: 🎨 "Low bit" a.k.a. 7-bit ASCII art items without control characters
biology-info: 🔬 Reference information useful in the study of biological issues
browser-data: 🚪 Data related to GUI browser software like Chrome, FireFox, etc.
cert-data: 📜 Information commonly utilized by cryptographic certificate materials
char-encodes: 🉐 Various character encodings provided by different locales/charsets
chat-data: 😮 Additional data on IRC, XMPP and other such messaging protocols
cipher-data: 🐡 Data denoting or used by cryptographic algorithm implementations
cmd-usage: 🔨 Help text shown in a terminal when attempting to execute CLI programs
cms-errors: ❗ Error codes and/or messages rendered by a CMS
code-keywords: ☕ Computer language identifiers declared in defining standards such as reserved words
cpu-arch: 🏭 Low-level computer architecture and hardware subjects
crypt-output: ✨ Cipher text string outputs created by cryptographic hash functions
database-strs: 💾 Strings often encountered when working with database software
dialup-modems: 📠 Info about analog modems on POTS
dns-commands: ♠️ Commands, packages, utilities, etc. used by the Domain Name System
dns-domains: 🌐 A list of domains that may or may not be found in the live DNS tree
dns-hostnames: 🔦 The host name part of an FQDN
dns-records: 🎫 Data specific to RR's in the DNS system
dns-servers: 🔋 Data provided to, produced by or related to DNS name servers
dns-toplevel: 🔝 TLD's or Top Level Domains are the uppermost part of DNS hierarchy
environ-names: ⛺ Environment variable names, settings, etc.
exploit-info: 🎱 Technical information on exploitation of security vulnerabilities
file-extens: ⚓ Anything concerning Filename extension, i.e. the part after the period in a file name
file-specs: 📁 File format specifications as distributed by vendor(s)/author(s)
ftp-data: 📤 Various FTP datum from RFC's and elsewhere
glibc-data: ⚙️ Data taken from the source code of the GNU C Library
html-words: ⌨️ Words not uncommon to come across when parsing HTML dialects
http-agents: 🎏 Software version banners for HTTP User Agents also known as browsers
http-headers: 🍪 Header fields sent in requests and responses by browsers/servers
http-methods: ▶️ Names of HTTP Request methods that are sent at the start of a browser's first request line
http-params: 🔡 Parameters browsers sometimes send when requesting server URI paths
http-paths: 🐾 Path names that browsers include in queries to servers
http-queries: ❔ The object syntax that appears after the question mark in URI's
http-security: 👮 Hyper Text Transfer Protocol security info, i.e. CSP
http-servers: 🏢 Information related to the usage of web server software
http-status: 🎰 Numeric HTTP status codes that denote the status of a web server during reply as specified in RFC7231, Section 6
inet-addrs: 🔌 Numeric Internet addresses a.k.a. IP addresses--mostly version 4
inet-routes: ☁️ Data useful in the maintenance and use of an Internet routing table
inet-services: ⛲ Lists of Internet protocols/daemons--similar to /etc/services
infosec-people: Noteworthy individuals within the information security community
iso-codes: ✔️ ISO code numbers and such
java-data: ☀️ Data found in or related to source code of programs written with Java
libc-data: 🏭 data for or about programming with the C standard library
linux-data: 🔟 Data identifiers and such from the Linux operating system
linux-paths: :linked_paperclips: Pathnames found on file systems created by Linux installations
malware-iocs: 💀 IOC for identification of malware infections
mobile-dev: 📱 Mobile device development for "handheld" form factors
net-attacks: ♨️ Info about attacks on telecommunications and Internetworks
net-ifaces: :three-networked-computers: Detailed information which can be extracted from network interfaces
ntfs-paths: 📂 File paths expected to be seen in NTFS folders
nvd-data: 🏛️ Datum utilized by NIST's NVD
owasp-data: 🐝 Data from or for OWASP
passes-dicts: 🔑 Dictionary files used in brute-force attacks against account passwords
passes-sites: 🔓 Password lists that were publicized after major site compromises
perl-data: 🐫 Data often seen in PERL (Practical Extraction and Report Language)
php-data: :page-facing-up: Files containing information about the PHP programming language
postal-data: 📬 United States Postal Service information
python-data: 🐍 Data used by the Python scripting language interpreter at runtime
radio-data: 📻 Things commonly used in radio frequency transmissions
regex-data: 💬 Regular expression patterns to mount attacks and match strings
ruby-data: 💎 Data typically seen within the syntax of the Ruby scripting language
search-dorks: 🔎 General purpose search-engine queries likely to find insecure sites
smtp-messages: ✉️ Messages (i.e. signatures, auto-replies, etc.) sent by SMTP servers
soap-messages: 📨 SOAP (Simple Object Access Protocol) messages
social-data: 👀 Sociological or social media related data sets
software-strs: 💽 Strings that describe software engineering, programming languages, etc.
string-enums: 🎡 Enumerations of values that aren't too terribly unusual
system-admin: 👔 System administration and BOFH related materials
system-notices: ⚠️ Disclaimer/warning messages shown by networked computer systems
telco-data: 📞 Data on voice-based telecommunications technologies: POTS, PCS, VoIP, SMS etc.
text-files: 📌 a special kind of "text file" as in those archived at textfiles.com, i.e. old school zine articles
text-words: ✏️ Lists of words likely to be found in an actual hard copy dictionary
top-secret: 👽 Files and/or data related to documents that were/are classified
unicode-art: 🎭 Unicode art pieces (i.e. requires wide character symbols)
unicode-data: 🔣 Unicode character usage and representation
unix-data: 🐚 Data associated with various flavors of the UNIX OS and its clones
unix-paths: 🗄️ File path names found in various UNIX file systems
uri-attacks: 💥 Malicious URI materials specially crafted for attack targets
uri-schemes: 📎 Lists containing references for URI schemes (part before colon)
uri-data: 🔗 Universal Resource Identifier related data
vuln-data: 📊 Information about security vulnerabilities found in server software
webapp-attacks: 💉 Security Proof-of-concept samples demonstrating various styles of web application attacks
webapp-data: 💼 Data associated with applications hosted on web servers
webapp-dirs: Directories related to applications running on a web server
webapp-files: 📇 Files related to applications running on a web server
webapp-paths: 📑 Path names related to applications running on a web server
webapp-words: 💭 Words related to applications running on a web server
web-sites: 🌎 Addresses to and/or information on well known/organized WWW sites
wifi-networks: 📡 IEEE 802.11 Wi-Fi network information
windows-data: 💼 Data only found within the Microsoft Windows series of OSes