Tired of the same old fuzzing lists that return no results?
Try the SquareSec custom-made collection of 9 API fuzzing wordlists.
Scraped from more than 120,000 public documentations, it contains fuzzing payloads for API ports, paths, parameters, objects, headers and many more:
744,000+ endpoints
357,000+ object properties
211,000+ object names
127,000+ query parameters
74,000+ parameter values
35,000+ path parameters
8,300+ headers
5,300+ paths
880+ common ports
Perfectly suitable for API discovery and reconnaissance to uncover new attack surface possibilities.
Not sure how to use it each list? Check out the details below 👇
Most likely ports where domains host their API
Possible URL path locations of the API
Custom HTTP request headers seen in other APIs
Path parameters identify a specific resource of the endpoint
Query parameters used to sort/filter the endpoint resources
List of possible values expected by APIs for a given parameter
List of properties to discover additional object values
Locations that accepts requests and sends back response
Common name of objects encountered in other APIs