Кастомные вордлисты для самых маленьких

katana -u https://example.com (-list urls.txt) -depth 5 -js-crawl -jsluice -known-files all -proxy http://127.0.0.1:8080 -rl 100 -o katana-example-com.out -v -H 'User-Agent: xxx' -H 'Cookie: xxx=xxx'

ffuf -c -w fuzz.txt -u https://example.com/FUZZ -rate 80 -t 5 -fc 403 -H "User-Agent: Mozilla Firefox" -r -replay-proxy http://127.0.0.1:8080 -o ffuf/-fuzz.out

cat  | gau --blacklist ttf,woff,svg,png,jpg --fc 404 --o gau.out --verbose

cat gau.out | grep -vE '\.ttf|\.woff|\.svg|\.png|\.jpg'

xnLinkFinder -i  -sp https://example.com -sf example.com -o xnlinkfinder.out -op xnlinkfinder-params.out -d 3

• Include URL path words? (в Parameters mode и в Words mode)
  
• JSON params (в Request и Response Parameters)
  
• Cookie names
  
• Name and Id attributes of HTML input fields
  
• Include potential params?
  
• Params from links found
  
• Selected target(s)

cat xnlinkfinder-deiteriypay-params.out http-deiteriypay.local/deiteriypay.local_20260414_155944_params.txt http-deiteriypay.local/deiteriypay.local_20260414_155944_words.txt | sort -u > wordlist-final.txt

• Param Miner

#!/usr/bin/env bash
set -euo pipefail
INPUT="${1:-wordlist-final.txt}"
OUTPUT="${2:-paths-mutated.txt}"
PREFIXES="deiteriy deit"
if [[ ! -f "$INPUT" ]]; then
    exit 1
fi
ATOMS=$(mktemp)
# Очистка и подготовка "атомов"
sed 's/[-_]/\n/g' "$INPUT" | \
    grep -v '[A-Z]' | \
    awk 'length >= 3' | \
    grep -vxE "$(echo $PREFIXES | tr ' ' '|')" | \
    sort -u > "$ATOMS"
# Генерация мутаций
awk -v prefixes="$PREFIXES" '
BEGIN { np = split(prefixes, px, " ") }
      { a[NR] = $0; n = NR }
END   {
    for (i = 1; i <= n; i++) {
        print a
        for (p = 1; p <= np; p++)
            print px[p] "-" a
    }
    for (i = 1; i <= n; i++) {
        for (j = 1; j <= n; j++) {
            if (i == j) continue
            combo = a "-" a[j]
            print combo
            for (p = 1; p <= np; p++)
                print px[p] "-" combo
        }
    }
}' "$ATOMS" | sort -u > "$OUTPUT"
rm -f "$ATOMS"