thekingofduck/fuzzdicts

★ 8,289PythonAudience · ops devopsComplexity · 1/5Setup · easy

Mindmap

mindmap
  root((fuzzdicts))
    What it does
      Pen test wordlists
      Attack payload collections
      Updated periodically
    Contents
      XSS payloads
      SQL injection strings
      Directory path lists
      Password dictionaries
    Paired Tools
      Burp Suite
      sqlmap
      Wfuzz
    Audience
      Pen testers
      Security researchers
      CTF players

mindmap root((fuzzdicts)) What it does Pen test wordlists Attack payload collections Updated periodically Contents XSS payloads SQL injection strings Directory path lists Password dictionaries Paired Tools Burp Suite sqlmap Wfuzz Audience Pen testers Security researchers CTF players

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Run directory brute-forcing with Wfuzz using the included path wordlists to discover hidden admin pages on a target web app.

USE CASE 2

Load the XSS payload list into Burp Suite Intruder to automatically test web forms for cross-site scripting vulnerabilities.

USE CASE 3

Feed the SQL injection strings to sqlmap as a custom payload list when testing database-backed login forms.

USE CASE 4

Check for default credential exposure on routers and web shells using the included password dictionaries.

Tech stack

Python

Getting it running

Difficulty · easy Time to first run · 5min

Plain text files, no installation needed. Run git pull before use to get the latest additions.

In plain English

fuzzDicts is a Chinese-maintained collection of wordlists for web security testing and penetration testing. The README is in Chinese, but the content itself (plain text lists of words, paths, and payloads) is language-neutral and usable in any testing tool. The description is direct: "Web Pentesting Fuzz dictionaries, one is enough." The repository is organized into separate folders by attack type. It includes: parameter name lists for fuzzing web form inputs (sourced from common PHP frameworks and CMS platforms like ThinkPHP, WordPress, and Discuz), XSS payload lists with hundreds of entries including official Burp Suite payloads, username dictionaries that include top Chinese surnames in phonetic spelling, common phone number patterns, and security researcher IDs, password dictionaries covering weak passwords for routers and security devices, webshell passwords, and a "strong-but-weak" password list of passwords that look complex but follow predictable patterns, directory path lists for finding hidden admin pages and common vulnerability paths, SQL injection fuzzing strings, SSRF test paths including Linux system file locations, XXE payloads, CTF challenge wordlists, API endpoint guesses, router admin panel default credentials, and file extension lists for upload bypass testing. There is also a subdomain dictionary and a JavaScript file dictionary. The repository is updated periodically. The maintainer recommends running git pull before use to pick up the latest additions. Community members can contribute new dictionaries by submitting pull requests. The README also lists recommended tools to pair with these dictionaries: Burp Suite, sqlmap, Wfuzz, xssfork, and webdirscan. These are standard penetration testing tools that accept wordlist files as input for automated scanning. This is a resource aimed at security professionals and penetration testers doing authorized assessments of web applications.

Copy-paste prompts

Prompt 1

I'm doing an authorized pen test. Show me how to use Wfuzz with the fuzzdicts directory wordlist to discover hidden paths on a target web application.

Prompt 2

How do I import a custom XSS payload list from fuzzdicts into Burp Suite Intruder and run it against a login form?

Prompt 3

Give me a sqlmap command that uses the fuzzdicts SQL injection strings against a login endpoint with a safe request rate.

Prompt 4

I want to test for SSRF vulnerabilities. Which fuzzdicts list should I use and how do I supply it to my testing tool?

Prompt 5

Walk me through setting up an authorized web app scan using fuzzdicts alongside Burp Suite and webdirscan.

Open on GitHub → Explain another repo

← thekingofduck on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.