CONTEXT · SIGNAL · RATE LIMITS

Wordlist Strategy

Choose and shape wordlists for the target and test objective instead of spraying giant lists with no hypothesis.

A wordlist is an input to a hypothesis. Match it to the technology, language, organization, and test objective before increasing volume.

PHASE 01

Choose the smallest useful list

Use technology-specific paths for content discovery, app vocabulary for parameters, and known account formats for authorized identity tests.

  • Start with common files and target terminology.
  • Do not use credential dumps outside explicit authorization.
Bug Bounty Playbook →

PHASE 02

Build custom candidates from evidence

Derive terms from JavaScript, documentation, error messages, naming conventions, and public product language.

  • Normalize case, separators, and file extensions.
  • Keep source notes so results are reproducible.
OWASP WSTG Testing Methodology →

PHASE 03

Control traffic and interpret results

Use concurrency and rate limits that fit scope. Filter soft 404s and baseline response size before treating a hit as real.

  • Sample results manually before expanding.
  • Log the list version, command, and response filters.
Security Report Templates →

Frequently asked questions

Should I always use the largest list?

No. Larger lists add noise and traffic. Start targeted, then expand only when evidence justifies it.