Enhanced Web Fuzzing: Improving Your Wordlists With Tooling And Methodology

The talk examines why the wordlists used in web fuzzing often let penetration testers down. The speaker argues that many public lists are sorted alphabetically, contain junk or dangerous entries, include irrelevant technologies, and miss known critical endpoints, such as a debug toolbar that exposes a Python interpreter. Tool defaults matter less than the list itself, and the list should be sized to the scope of the engagement.

The middle of the talk presents a new open-source tool that attaches metadata to each path: criticality, observed count, category, tags and a reference link to a CVE or advisory. Entries can be ingested from CSV files or existing lists, stored in a SQLite database, and generated as lists sorted by criticality and filtered by context or size. The built-in data draws on bug bounty reports, exploit databases, security advisories, Nuclei templates, fuzzing logs and internal engagement findings. In a comparison with common lists, hundreds of critical entries were found to be missing. A live demo against a lab running Symfony showed a discovered endpoint leading to a leaked secret and then to code execution.

The speaker reports five years of internal use, with about 22,500 built-in entries, roughly a third of them manually reviewed. The main takeaways are to review wordlists before relying on them, sort by impact, trim the list to fit the target, and keep it maintained. The generated full list is published for download and updated with each project commit.