一个组合多位师傅的渗透测试字典 建议收藏
content
参数Fuzz字典
Xss Fuzz字典
用户名字典
密码字典
目录字典
sql-fuzz字典
ssrf-fuzz字典
XXE字典
ctf字典
Api字典
路由器后台字典
文件后缀Fuzz
js文件字典
子域名字典
工具推荐：burpsuite,sqlmap,xssfork,Wfuzz,webdirscan
如果有什么的好字典或是建议欢迎提交issue给我。
参数Fuzz字典
https:// github.com/TheKingOfDuc k/fuzzDicts/blob/master/paramDict/parameter.txt
采集自ThinkPHP,yii2,phphub,Zblog,DiscuzX,WordPress等常见PHP框架/CMS。
使用技巧：如http://127.0.0.1/1.php ,视为可疑文件，进行fuzz param 选择GET,POST AND (POST JSON) AND (GET Route) AND cookie param
Xss Fuzz字典
https:// github.com/TheKingOfDuc k/easyXssPayload/blob/master/easyXssPayload.txt
采集自github。
用户名字典
https:// github.com/TheKingOfDuc k/fuzzDicts/tree/master/userNameDict
密码字典
https:// github.com/TheKingOfDuc k/fuzzDicts/tree/master/passwordDict
目录字典
https:// github.com/TheKingOfDuc k/fuzzDicts/tree/master/directoryDicts
SQL Fuzz字典
https:// github.com/TheKingOfDuc k/fuzzDicts/blob/master/sqlDict/sql.txt
ssrf fuzz字典
https:// github.com/TheKingOfDuc k/fuzzDicts/blob/master/ssrfDicts
由\xeb\xfe师傅提供。
XXE字典
https:// github.com/TheKingOfDuc k/fuzzDicts/tree/master/XXEDicts
收集自百度。
ctf字典
https:// github.com/TheKingOfDuc k/fuzzDicts/tree/master/ctfDict
采集自kingkaki，原先收集时百度直接下载的压缩包，没看到github链接，所以没标记来源，抱歉抱歉
Api字典
https:// github.com/TheKingOfDuc k/fuzzDicts/tree/master/apiDict/api.txt
钟馗采集的代码写得很cxk 我真弟弟。。。
路由器后台字典
https:// github.com/TheKingOfDuc k/fuzzDicts/tree/master/routerDicts/pass.txt
文件后缀Fuzz
https:// github.com/TheKingOfDuc k/fuzzDicts/tree/master/uploadFileExtDicts
采集自 https:// github.com/c0ny1/upload -fuzz-dic-builder
js文件字典
采集自: https:// github.com/7dog7/bottle neckOsmosis
文章来源：