fuzzDicts
You Know, For WEB Fuzzing !
A comprehensive collection of wordlists for authorized web security testing, covering XSS payloads, SQL injection strings, hidden directory paths, username and password lists, and more for use with standard penetration testing tools.
fuzzDicts is a Chinese-maintained collection of wordlists for web security testing and penetration testing. The README is in Chinese, but the content itself (plain text lists of words, paths, and payloads) is language-neutral and usable in any testing tool. The description is direct: "Web Pentesting Fuzz dictionaries, one is enough."
The repository is organized into separate folders by attack type. It includes: parameter name lists for fuzzing web form inputs (sourced from common PHP frameworks and CMS platforms like ThinkPHP, WordPress, and Discuz); XSS payload lists with hundreds of entries including official Burp Suite payloads; username dictionaries that include top Chinese surnames in phonetic spelling, common phone number patterns, and security researcher IDs; password dictionaries covering weak passwords for routers and security devices, webshell passwords, and a "strong-but-weak" password list of passwords that look complex but follow predictable patterns; directory path lists for finding hidden admin pages and common vulnerability paths; SQL injection fuzzing strings; SSRF test paths including Linux system file locations; XXE payloads; CTF challenge wordlists; API endpoint guesses; router admin panel default credentials; and file extension lists for upload bypass testing. There is also a subdomain dictionary and a JavaScript file dictionary.
The repository is updated periodically. The maintainer recommends running git pull before use to pick up the latest additions. Community members can contribute new dictionaries by submitting pull requests.
The README also lists recommended tools to pair with these dictionaries: Burp Suite, sqlmap, Wfuzz, xssfork, and webdirscan. These are standard penetration testing tools that accept wordlist files as input for automated scanning.
This is a resource aimed at security professionals and penetration testers doing authorized assessments of web applications.
Where it fits
- Run directory brute-forcing with Wfuzz using the included path wordlists to discover hidden admin pages on a target web app.
- Load the XSS payload list into Burp Suite Intruder to automatically test web forms for cross-site scripting vulnerabilities.
- Feed the SQL injection strings to sqlmap as a custom payload list when testing database-backed login forms.
- Check for default credential exposure on routers and web shells using the included password dictionaries.