Skip to content


SolomonSklash edited this page Mar 8, 2019 · 2 revisions


A variety of wordlists are used, both for subdomain bruteforcing and content discovery. Daniel Miessler's Seclists are used heavily, as well as Jason Haddix's lists. Different wordlists can be used by passing in a custom wordlist or using one of the built-in named argument lists below.

Subdomain Bruteforcing

Argument Name Filename Word Count Description
SHORT subdomains-top1mil-20000.txt 22k From Seclists
LONG sortedcombined-knock-dnsrecon-fierce-reconng.txt 102k From Seclists
HUGE huge-200k.txt 199k Combination I made of various wordlists, including Seclists

Content Discovery

Argument Name Filename Word Count Description
SMALL big.txt 20k From Seclists
MEDIUM raft-large-combined.txt 167k Combination of the raft wordlists in Seclists
LARGE seclists-combined.txt 215k Larger combination of all the Discovery/DNS lists in Seclists
XL haddix_content_discovery_all.txt 373k Jason Haddix's all content discovery list
XXL haddix-seclists-combined.txt 486k Combination of the two previous lists
Clone this wiki locally
You can’t perform that action at this time.