Wordlist Selection Guide
| Wordlist | Path | When to Use |
|---|---|---|
directory-list-2.3-medium.txt | /usr/share/wordlists/seclists/Discovery/Web-Content/ | Default first choice · balanced speed vs coverage |
directory-list-2.3-big.txt | /usr/share/wordlists/seclists/Discovery/Web-Content/ | When medium misses things · slower but more thorough |
raft-large-directories.txt | /usr/share/wordlists/seclists/Discovery/Web-Content/ | Best for finding hidden admin panels, non-standard paths |
common.txt | /usr/share/wordlists/dirb/ | Very fast, high-value paths only · use when time is limited |
big.txt | /usr/share/wordlists/dirb/ | Good secondary pass |
quickhits.txt | /usr/share/wordlists/seclists/Discovery/Web-Content/ | Known vulnerable/sensitive paths · run this always |
gobuster
Standard directory scan
gobuster dir \ -u http://<TARGET-IP> \ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \ -x php,html,txt,bak,old,zip,sql,conf,js \ -o scans/gobuster_med.txt \ -t 50 \ --timeout 10s
HTTPS (ignore cert errors)
gobuster dir -u https://<TARGET-IP> -k \ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \ -x php,html,txt -o scans/gobuster_https.txt
Virtual host discovery
gobuster vhost \ -u http://<DOMAIN> \ -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt \ -o scans/vhosts.txt
DNS subdomain enum
gobuster dns \ -d <DOMAIN> \ -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt \ -r <TARGET-IP>
ffuf
Directory/file fuzzing
ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \ -u http://<TARGET-IP>/FUZZ \ -e .php,.html,.txt,.bak \ -o scans/ffuf_dirs.json \ -mc 200,204,301,302,307,403
POST parameter fuzzing
ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt \ -u http://<TARGET-IP>/form.php \ -X POST \ -d "FUZZ=test" \ -H "Content-Type: application/x-www-form-urlencoded" \ -mc 200 -fs <BASELINE-SIZE>
Virtual host discovery with ffuf
ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt \ -u http://<TARGET-IP> \ -H "Host: FUZZ.<DOMAIN>" \ -mc 200 -fs <BASELINE-SIZE>
feroxbuster (recursive · best for deep crawling)
feroxbuster \ -u http://<TARGET-IP> \ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt \ -x php,html,txt,js,json \ -o scans/ferox.txt \ --depth 3 \ -t 50