Wolf

A wordlist and payload collection for penetration testing, bug bounty, and red-team work.

More than 2,500 curated lists across eight domains: credentials, content discovery, DNS, injection payloads, HTTP fuzzing, dorks, and AI/LLM testing. Everything is sorted by purpose, so you can find the right list without grep-ing through a monolith.

---

Contents

Domain	Files	What's inside
Credentials/	689	Passwords, usernames, hashes, default creds, secrets, malware signatures
DIRS/	350	Directory and file discovery — admin panels, backups, APIs, CVEs, per-technology paths
DNS/	28	Subdomains, resolvers, permutations, TLDs, virtual hosts
Dork/	5	Google, Shodan, and Git dorks
Exploits/	1,168	Payloads grouped by attack class (XSS, RCE, SSRF, LFI, SSTI, JWT, and more)
HTTP/	110	Headers, methods, parameters, user-agents, MIME types, schemes
VULNS/	202	Injection and web payloads grouped by vulnerability (SQLi, XXE, CRLF, NoSQL, …)
Ai/	12	Prompt-injection and LLM-testing strings

Exploits/ and VULNS/ overlap on purpose: Exploits/ is organized by how you attack, VULNS/ by the weakness you're confirming. Use whichever framing fits your workflow.

---

Layout

Wolf/
├── Ai/                  LLM.txt, LLM_Testing/            — prompt injection & AI abuse
├── Credentials/
│   ├── Default-Credentials/  IoT-Devices, OS, Routers, Services
│   ├── Hashes/               Cracked, Oracle, PHP
│   ├── Malware/
│   ├── Passwords/            Common, Themed, Language-Specific, Patterns, Intelligence
│   ├── Secrets/
│   └── Usernames/            Regions, other
├── DIRS/                Admin-Login-Panels, APIs, Backups-and-DB, CVEs, TECHS/, …
├── DNS/                 Subdomains, Resolvers, Permutations, TLDs, VirtualHosts
├── Dork/                Google, Shodan, Git, Google-Specefic
├── Exploits/            One folder per attack class (XSS, RCE, SSRF, JWT Attacks, …)
├── HTTP/                Headers, User-Agents, parameters, Content-Types-MIME, schemes
└── VULNS/               One folder per vulnerability (SQLI, XXE, SSTI, LFI, RFI, …)

Every leaf folder holds plain-text lists (one entry per line) that drop straight into ffuf, feroxbuster, hashcat, nuclei, sqlmap, Burp Intruder, and similar tools.

---

Large files

GitHub rejects any single file over 100 MB, so the eight biggest lists ship compressed, and split into parts where the compressed copy still exceeds the limit. The raw originals are not tracked here; you rebuild them locally in one step.

Affected lists include rockyou.txt, crackstation-human-only, the mypasswords collection, dirs-all.txt, subdomains-all.txt, and webshell-master.zip.

Rebuild them

python restore-large-files.py

The script walks the repo, concatenates every *.001, *.002, … part group back into its original archive, and unwraps the single-file .zip copies of plain-text lists. Add --clean to delete the parts and wrappers once the originals are restored:

python restore-large-files.py --clean

No dependencies; Python 3.6 or newer is all you need. Files that were already compressed (.gz, .zip, .tar.gz) are left as-is after reassembly; decompress them with gzip -d, unzip, or tar xzf when you need them.

---

Getting it

git clone https://github.com/0xbugatti/wolf.git
cd wolf
python restore-large-files.py      # rebuild the split/compressed lists

To pull a single domain instead of the whole repo, use a sparse checkout:

git clone --filter=blob:none --sparse https://github.com/0xbugatti/wolf.git
cd wolf
git sparse-checkout set Exploits VULNS

---

Usage examples

# Content discovery
ffuf -w DIRS/Bruteforce/dirs-all.txt -u https://target/FUZZ

# Subdomain brute force
ffuf -w DNS/Subdomains/subdomains-all.txt -u https://FUZZ.target -H "Host: FUZZ.target"

# Password cracking
hashcat -m 0 hashes.txt Credentials/Passwords/Common/Huge/rockyou.txt

# Parameter fuzzing
ffuf -w HTTP/parameters/params-all.txt -u "https://target/api?FUZZ=test"

# Injection testing with Burp Intruder / sqlmap: load any list under Exploits/ or VULNS/

---

Contributing

Additions and corrections are welcome. Keep the structure consistent:

• One entry per line, no trailing whitespace, UTF-8.
• Put a list in the folder that matches its purpose; create a new leaf folder only when nothing fits.
• Deduplicate before you commit (sort -u).
• Keep new files under 100 MB, or split them the same way the existing large lists are split so restore-large-files.py can rebuild them.

---

Sources & credit

This is a curated aggregation. Individual lists are drawn from and inspired by public collections including SecLists, PayloadsAllTheThings, Assetnote, and years of field notes. Credit stays with the original authors of each list.

Legal

For authorized security testing and education only. Use these lists only against systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal. You are responsible for how you use this material.

License

Released under the MIT License. See LICENSE.