Web Pentesting Fuzz 字典,一个就够了。
20190801：合并了一个r35tart师傅整理的很好的“强弱口令”字典（即看起来很复杂，单但实际上很多人在用的密码）
20190615：合并了一个国外的字典 感觉分类有点乱 考完试再重新整理一下咯。
- 参数Fuzz字典
- Xss Fuzz字典
- 用户名字典
- 密码字典
- 目录字典
- sql-fuzz字典
- ssrf-fuzz字典
- XXE字典
- ctf字典
- Api字典
- 路由器后台字典
- 文件后缀Fuzz
- js文件字典
工具推荐：burpsuite,sqlmap,xssfork,Wfuzz,webdirscan
如果有什么的好字典或是建议欢迎提交issue给我。
https://github.com/TheKingOfDuck/fuzzDicts/blob/master/paramDict/parameter.txt
采集自ThinkPHP,yii2,phphub,Zblog,DiscuzX,WordPress等常见PHP框架/CMS。
使用技巧：如http://127.0.0.1/1.php ,视为可疑文件，进行fuzz param 选择GET,POST AND (POST JSON) AND (GET Route) AND cookie param
https://github.com/TheKingOfDuck/easyXssPayload/blob/master/easyXssPayload.txt
采集自github。
https://github.com/TheKingOfDuck/fuzzDicts/tree/master/userNameDict
https://github.com/TheKingOfDuck/fuzzDicts/tree/master/passwordDict
https://github.com/TheKingOfDuck/fuzzDicts/tree/master/directoryDicts
https://github.com/TheKingOfDuck/fuzzDicts/blob/master/sqlDict/sql.txt
https://github.com/TheKingOfDuck/fuzzDicts/blob/master/ssrfDicts
由\xeb\xfe师傅提供。
https://github.com/TheKingOfDuck/fuzzDicts/tree/master/XXEDicts
收集自百度。
https://github.com/TheKingOfDuck/fuzzDicts/tree/master/ctfDict
收集自百度[侵删]。
https://github.com/TheKingOfDuck/fuzzDicts/tree/master/apiDict/api.txt
钟馗采集的代码写得很cxk 我真弟弟。。。
https://github.com/TheKingOfDuck/fuzzDicts/tree/master/routerDicts/pass.txt
https://github.com/TheKingOfDuck/fuzzDicts/tree/master/uploadFileExtDicts
