⚠️ Core rule: dictionaries are uniformly under the /pentest directory — the aboutsecurity dictionary repository and the nuclei template repository are both installed under /pentest/ .
📁 Dictionary repository (Dic/) — directory brute-forcing / password brute-forcing / parameter Fuzz
Toolchain
# 查看字典库分类
ls /pentest/AboutSecurity/Dic/
# 查看 Web 字典子分类
ls /pentest/AboutSecurity/Dic/web/
# 使用字典（示例）
spray -u http://target -d /pentest/AboutSecurity/Dic/web/directory/common.txt
ffuf -u http://target/FUZZ -w /pentest/AboutSecurity/Dic/web/directory/common.txt
Common dictionary quick reference table
| Scenario | Path | Line count |
|---|---|---|
| General directory brute-forcing | Dic/web/directory/common.txt |
5378 |
| PHP file discovery | Dic/web/directory/php/php.txt |
48094 |
| PHP Top100 | Dic/web/directory/php/top100-php.txt |
93 |
| CTF URI Fuzz | Dic/web/ctf/uri.txt |
222 |
| CTF parameter Fuzz | Dic/web/ctf/param.txt |
44 |
| CTF SQL Fuzz | Dic/web/ctf/sql.txt |
94 |
| Admin panel paths | Dic/web/directory/admin-dir.txt |
2166 |
| API paths | Dic/web/directory/api.txt |
341 |
| Backup files | Dic/web/file-backup/ |
— |
| Top 100 passwords | Dic/auth/password/password-top100.txt |
172 |
| DNS subdomains | Dic/web/dns/ |
— |
Decision tree: which dictionary should I use?
目标是 Web 应用？
├── CTF/靶场 → Dic/web/ctf/uri.txt（小而精）
├── PHP 站 → Dic/web/directory/php/php.txt（全面）
├── 通用站 → Dic/web/directory/common.txt
├── 找后台 → Dic/web/directory/admin-dir.txt
├── 找 API → Dic/web/directory/api.txt
└── 找备份 → Dic/web/file-backup/
目标是认证服务？
├── 密码爆破 → Dic/auth/password/password-top100.txt
├── 用户名枚举 → Dic/auth/username/
└── 特定服务 → Dic/port/{mysql,ssh,rdp,...}/
📁 Payload repository — vulnerability verification payloads
Toolchain
# 查看 aboutsecurity payload 分类
ls /pentest/AboutSecurity/Payload/
# 查看 nuclei 模板库
ls ~/nuclei-templates/
# 读取具体 payload 文件
cat /pentest/AboutSecurity/Payload/sqli/payload.txt # 通用 SQLi Fuzz payload
cat /pentest/AboutSecurity/Payload/sqli/sql-inj.md # 快速查阅速查手册（含 WAF 绕过技巧）
Available categories
sqli | xss | lfi | ssrf | xxe | rce | access-bypass | upload | cors | hpp | ssi
⚠️ The correct workflow for using external tools
❌ 错误：ffuf -u http://target/FUZZ -w /usr/share/wordlists/common.txt
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
猜测路径，大概率不存在
✅ 正确：
1. ls /pentest/AboutSecurity/Dic/web/directory/ → 确认字典存在
2. ffuf -u http://target/FUZZ -w /pentest/AboutSecurity/Dic/web/directory/common.txt
💡 Tips for efficient use
- spray / ffuf already wrap dictionaries — if it is just simple directory brute-forcing, directly use
spray -u target -d wordlist.txtorffuf -u target/FUZZ -w wordlist.txt - Use ffuf for custom parameters — when custom parameters are needed (such as -e .bak -mc 200), use
ffuf -u target/FUZZ -w /pentest/AboutSecurity/Dic/... - For CTF scenarios, prioritize small dictionaries — the dictionaries under Dic/web/ctf/ are streamlined and highly targeted, avoiding wasting time with large dictionaries