https://github.com/chrislockard/api_wordlist

A wordlist of API names for web application assessments
https://github.com/chrislockard/api_wordlist

Last synced: about 1 month ago
JSON representation

A wordlist of API names for web application assessments

• Host: GitHub
• URL: https://github.com/chrislockard/api_wordlist
• Owner: chrislockard
• Created: 2015-08-20T13:41:29.000Z (over 9 years ago)
• Default Branch: master
• Last Pushed: 2023-01-20T13:07:22.000Z (almost 2 years ago)
• Last Synced: 2024-08-03T01:24:27.174Z (4 months ago)
• Size: 87.9 KB
• Stars: 706
• Watchers: 14
• Forks: 205
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-rainmana - chrislockard/api_wordlist - A wordlist of API names for web application assessments (Others)
• awesome-api-security - API names wordlist

README

        
# api_wordlist

A wordlist of API names used for fuzzing web application APIs.

## Contents

- api_seen_in_wild.txt - This contains API function names I've seen in the wild.

- actions.txt - All API function name verbs

- objects.txt - All API function name nouns

- actions-uppercase.txt - API function name verbs with leading character upper-case

- actions-lowercase.txt - API function name verbs with leading character lower-case

- objects-uppercase.txt - API function name nouns with leading character upper-case

- objects-lowercase.txt - API function name nouns with leading character lower-case

## Usage

1.  In burpsuite, send an API request you want to fuzz to Intruder.

2.  Remove the existing API function call, and replace it with two § characters for each text file you want to use.

3.  On the "Positions" tab, set Attack type to "Cluster Bomb".

4.  On the "Payloads" tab, select 1 for the fist Payload set drop-down, then select a Payload type of "Runtime file" and navigate to the directory you downloaded these text files to. Select "actions.txt".

5.  Repeat step 4 by setting Payload set 2 to "objects.txt".

6.  (optional step - add more payload sets and set them to "objects.txt" to test for multi-part objects like "UserAccount")

7.  Start attack!

## Comments

If you use this and it's helpful, I'd love to hear about it! (@[email protected]). If you think I've missed any obvious word choices, I'd love to hear about that as well, or feel free to add them.