ad-attacks
Active Directory attack reference — BloodHound Cypher queries, Kerberos attack decision tree, ACE/ACL abuse, ADCS ESC1-8, and AD…
@mukul975Install SkillSecurity
Skill
/wordlists
SecLists path map, hashcat rules, CeWL usage, and custom wordlist generation for all attack categories
Claude Code
$ npx -y skills add mukul975/Threatswarm --skill wordlists --agent claude-code
Codex
$ npx skills add mukul975/Threatswarm --skill wordlists -a codex -y
Cursor
$ npx skills add mukul975/Threatswarm --skill wordlists -a cursor -y
Gemini CLI
$ npx skills add mukul975/Threatswarm --skill wordlists -a gemini-cli -y
GitHub Copilot
$ npx skills add mukul975/Threatswarm --skill wordlists -a github-copilot -y
OpenCode
$ npx skills add mukul975/Threatswarm --skill wordlists -a opencode -y
Windsurf
$ npx skills add mukul975/Threatswarm --skill wordlists -a windsurf -y
SKILL.md
wordlists.SKILL.mdname: wordlists
description: SecLists path map, hashcat rules, CeWL usage, and custom wordlist generation for all attack categories
allowed-tools: Bash, Read
SecLists Path Map
Base path: `/usr/share/seclists/`
Subdomain / DNS Enumeration
Discovery/DNS/bitquark-subdomains-top100000.txt # Top 100k subdomains
Discovery/DNS/subdomains-top1million-110000.txt # 1M subdomains
Discovery/DNS/shubs-subdomains.txt # Alternative quality list
Discovery/DNS/dns-Jhaddix.txt # Comprehensive subdomain list
Discovery/DNS/namelist.txt # Short, fast list
Discovery/DNS/fierce-hostlist.txt # Fierce default list
Discovery/DNS/combined_subdomains.txt # Combined mega list
Web Directory / Content Enumeration
Discovery/Web-Content/raft-medium-words.txt # Balanced: 63k entries (RECOMMENDED)
Discovery/Web-Content/raft-large-words.txt # Large: 119k entries
Discovery/Web-Content/raft-small-words.txt # Fast: 43k entries
Discovery/Web-Content/directory-list-2.3-medium.txt # Dirb classic medium
Discovery/Web-Content/directory-list-2.3-big.txt # Dirb classic big
Discovery/Web-Content/common.txt # Quick 4k common paths
Discovery/Web-Content/big.txt # 20k common paths
Discovery/Web-Content/raft-medium-directories.txt # Directories only
Discovery/Web-Content/raft-medium-files.txt # Files only
Discovery/Web-Content/raft-medium-extensions.txt # Extension enumeration
Discovery/Web-Content/SVNDigger/all.txt # SVN/code repos
Discovery/Web-Content/CMS/ # CMS-specific lists
Discovery/Web-Content/IIS.fuzz.txt # IIS-specific
Discovery/Web-Content/nginx.txt # Nginx-specific
API Endpoints
Discovery/Web-Content/api/api-endpoints.txt # Common API paths
Discovery/Web-Content/api/api-endpoints-res.txt # API resource patterns
Discovery/Web-Content/api/api-seen-in-wild.txt # Wild API endpoints
Discovery/Web-Content/api/objects.txt # API object names
Discovery/Web-Content/api/actions.txt # API action names
Discovery/Web-Content/api/graphql.txt # GraphQL endpoint paths
Passwords by Service
# SSH brute force
/usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt
/usr/share/wordlists/rockyou.txt # Classic 14M
# HTTP form brute force
/usr/share/seclists/Passwords/Common-Credentials/best1050.txt
/usr/share/seclists/Passwords/Common-Credentials/best110.txt
/usr/share/seclists/Passwords/Leaked-Databases/rockyou-75.txt
# Default credentials (service-specific)
/usr/share/seclists/Passwords/Default-Credentials/default-passwords.csv
/usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt
/usr/share/seclists/Passwords/Default-Credentials/mssql-betterdefaultpasslist.txt
/usr/share/seclists/Passwords/Default-Credentials/mysql-betterdefaultpasslist.txt
/usr/share/seclists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist.txt
# Web application defaults
/usr/share/seclists/Passwords/darkweb2017-top10000.txt
/usr/share/seclists/Passwords/Leaked-Databases/rockyou-10.txt
/usr/share/seclists/Passwords/Leaked-Databases/rockyou-25.txt
# SNMP community strings
/usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt
/usr/share/seclists/Discovery/SNMP/snmp.txt
# WPA handshake cracking
/usr/share/wordlists/rockyou.txt # Start here
/usr/share/seclists/Passwords/WiFi-WPA/probable-v2-wpa-top4800.txt
# VNC/RDP brute
/usr/share/seclists/Passwords/Common-Credentials/500-worst-passwords.txt
# WordPress xmlrpc brute
/usr/share/seclists/Passwords/Common-Credentials/best1050.txt
Usernames
Usernames/top-usernames-shortlist.txt # 17 common usernames
Usernames/Names/names.txt # First names
Usernames/cirt-default-usernames.txt # Device default users
Usernames/CommonAdminBase64.txt # Admin base64 encoded
Usernames/mssql-betterdefaultpasslist.txt # MSSQL defaults
Fuzzing
# LFI / Path Traversal
Fuzzing/LFI/LFI-Jhaddix.txt # 929 LFI payloads (BEST)
Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt # Huge LFI list
Fuzzing/LFI/LFI-gracefulsecurity-linux.txt # Linux-specific
Fuzzing/LFI/LFI-gracefulsecurity-windows.txt # Windows-specific
# XSS
Fuzzing/XSS/XSS-Jhaddix.txt # Comprehensive XSS payloads
Fuzzing/XSS/XSS-BruteLogic.txt # BruteLogic collection
Fuzzing/XSS/XSS-Bypass-Strings-BruteLogic.txt # WAF bypass payloads
Fuzzing/XSS/xss-payload-list.txt # Extended XSS list
# SQL Injection
Fuzzing/SQLi/Generic-SQLi.txt # Generic SQL injection
Fuzzing/SQLi/quick-SQLi.txt # Quick test payloads
Fuzzing/SQLi/MySQL-SQLi-Login-Bypass.txt # MySQL login bypass
Fuzzing/SQLi/MSSQL-Enumeration.fuzzdb.txt # MSSQL enumeration
# SSTI
Fuzzing/template-engines-expression.txt # Template injection payloads
# SSRF
Fuzzing/SSRF/SSRF-payloads.txt # SSRF bypass payloads
# XXE
Fuzzing/XXE/ # XXE payloads directory
# Open Redirect
Fuzzing/open-redirects-payloads.txt # Open redirect vectors
IDOR / ID Enumeration
# Numeric IDs
seq 1 10000 # Pipe to ffuf: -w <(seq 1 10000)
seq 1 1000000 | shuf | head -10000 # Random sample
# UUID generation
python3 -c "import uuid; [print(uuid.uuid4()) for _ in range(1000)]"
# Alphanumeric short IDs
Read more
name: wordlists description: SecLists path map, hashcat rules, CeWL usage, and custom wordlist generation for all attack categories allowed-tools: Bash, Read
SecLists Path Map
Base path: `/usr/share/seclists/`
Subdomain / DNS Enumeration
Discovery/DNS/bitquark-subdomains-top100000.txt # Top 100k subdomains Discovery/DNS/subdomains-top1million-110000.txt # 1M subdomains Discovery/DNS/shubs-subdomains.txt # Alternative quality list Discovery/DNS/dns-Jhaddix.txt # Comprehensive subdomain list Discovery/DNS/namelist.txt # Short, fast list Discovery/DNS/fierce-hostlist.txt # Fierce default list Discovery/DNS/combined_subdomains.txt # Combined mega list
Web Directory / Content Enumeration
Discovery/Web-Content/raft-medium-words.txt # Balanced: 63k entries (RECOMMENDED) Discovery/Web-Content/raft-large-words.txt # Large: 119k entries Discovery/Web-Content/raft-small-words.txt # Fast: 43k entries Discovery/Web-Content/directory-list-2.3-medium.txt # Dirb classic medium Discovery/Web-Content/directory-list-2.3-big.txt # Dirb classic big Discovery/Web-Content/common.txt # Quick 4k common paths Discovery/Web-Content/big.txt # 20k common paths Discovery/Web-Content/raft-medium-directories.txt # Directories only Discovery/Web-Content/raft-medium-files.txt # Files only Discovery/Web-Content/raft-medium-extensions.txt # Extension enumeration Discovery/Web-Content/SVNDigger/all.txt # SVN/code repos Discovery/Web-Content/CMS/ # CMS-specific lists Discovery/Web-Content/IIS.fuzz.txt # IIS-specific Discovery/Web-Content/nginx.txt # Nginx-specific
API Endpoints
Discovery/Web-Content/api/api-endpoints.txt # Common API paths Discovery/Web-Content/api/api-endpoints-res.txt # API resource patterns Discovery/Web-Content/api/api-seen-in-wild.txt # Wild API endpoints Discovery/Web-Content/api/objects.txt # API object names Discovery/Web-Content/api/actions.txt # API action names Discovery/Web-Content/api/graphql.txt # GraphQL endpoint paths
Passwords by Service
# SSH brute force /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt /usr/share/wordlists/rockyou.txt # Classic 14M # HTTP form brute force /usr/share/seclists/Passwords/Common-Credentials/best1050.txt /usr/share/seclists/Passwords/Common-Credentials/best110.txt /usr/share/seclists/Passwords/Leaked-Databases/rockyou-75.txt # Default credentials (service-specific) /usr/share/seclists/Passwords/Default-Credentials/default-passwords.csv /usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt /usr/share/seclists/Passwords/Default-Credentials/mssql-betterdefaultpasslist.txt /usr/share/seclists/Passwords/Default-Credentials/mysql-betterdefaultpasslist.txt /usr/share/seclists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist.txt # Web application defaults /usr/share/seclists/Passwords/darkweb2017-top10000.txt /usr/share/seclists/Passwords/Leaked-Databases/rockyou-10.txt /usr/share/seclists/Passwords/Leaked-Databases/rockyou-25.txt # SNMP community strings /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt /usr/share/seclists/Discovery/SNMP/snmp.txt # WPA handshake cracking /usr/share/wordlists/rockyou.txt # Start here /usr/share/seclists/Passwords/WiFi-WPA/probable-v2-wpa-top4800.txt # VNC/RDP brute /usr/share/seclists/Passwords/Common-Credentials/500-worst-passwords.txt # WordPress xmlrpc brute /usr/share/seclists/Passwords/Common-Credentials/best1050.txt
Usernames
Usernames/top-usernames-shortlist.txt # 17 common usernames Usernames/Names/names.txt # First names Usernames/cirt-default-usernames.txt # Device default users Usernames/CommonAdminBase64.txt # Admin base64 encoded Usernames/mssql-betterdefaultpasslist.txt # MSSQL defaults
Fuzzing
# LFI / Path Traversal Fuzzing/LFI/LFI-Jhaddix.txt # 929 LFI payloads (BEST) Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt # Huge LFI list Fuzzing/LFI/LFI-gracefulsecurity-linux.txt # Linux-specific Fuzzing/LFI/LFI-gracefulsecurity-windows.txt # Windows-specific # XSS Fuzzing/XSS/XSS-Jhaddix.txt # Comprehensive XSS payloads Fuzzing/XSS/XSS-BruteLogic.txt # BruteLogic collection Fuzzing/XSS/XSS-Bypass-Strings-BruteLogic.txt # WAF bypass payloads Fuzzing/XSS/xss-payload-list.txt # Extended XSS list # SQL Injection Fuzzing/SQLi/Generic-SQLi.txt # Generic SQL injection Fuzzing/SQLi/quick-SQLi.txt # Quick test payloads Fuzzing/SQLi/MySQL-SQLi-Login-Bypass.txt # MySQL login bypass Fuzzing/SQLi/MSSQL-Enumeration.fuzzdb.txt # MSSQL enumeration # SSTI Fuzzing/template-engines-expression.txt # Template injection payloads # SSRF Fuzzing/SSRF/SSRF-payloads.txt # SSRF bypass payloads # XXE Fuzzing/XXE/ # XXE payloads directory # Open Redirect Fuzzing/open-redirects-payloads.txt # Open redirect vectors
IDOR / ID Enumeration
# Numeric IDs seq 1 10000 # Pipe to ffuf: -w <(seq 1 10000) seq 1 1000000 | shuf | head -10000 # Random sample # UUID generation python3 -c "import uuid; [print(uuid.uuid4()) for _ in range(1000)]" # Alphanumeric short IDs
Ships withthreatswarm
27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code plugin. Backed by 754 MITRE-mapped skills.
975 skills27 agents
Stars on GitHub
Momentum
- stars in total
- 97
Other skills on threatswarm.
@mukul975Install Skillexploit-db
Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and…
@mukul975Install Skillmitre-attack
MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule…
@mukul975Install Skillreport-templates
CVSS 3.1 vector examples, executive summary template, full technical finding template, and remediation language bank for pentest…
@mukul975Install SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about wordlists.
- Which coding agents can use wordlists?
- wordlists installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.