# Small Directory Wordlist
# Common directories and files for web enumeration

# Admin Panels
admin
administrator
adm
administration
adminpanel
panel
cp
cpanel
controlpanel
manage
management
manager
moderator
mod
root
superuser
sysadmin
system
dashboard
admin.php
admin.asp
admin.aspx
admin.jsp
admin.html
login
signin
logon
auth
authenticate

# Configuration Files
config
configuration
conf
settings
setup
install
.htaccess
.htpasswd
web.config
robots.txt
sitemap.xml
sitemap.xml.gz
crossdomain.xml
clientaccesspolicy.xml
.ssh
.bash_history
.bashrc
.profile
.git
.gitignore
.git/config
.svn
.svn/entries
.hg
.bzr
.env
.env.backup
.env.dev
.env.local
.env.production
.env.staging
.aws
.aws/credentials
.docker
.docker/config.json
composer.json
composer.lock
package.json
package-lock.json
yarn.lock
Gemfile
Gemfile.lock
requirements.txt
Pipfile
Pipfile.lock
Dockerfile
docker-compose.yml
docker-compose.yaml
Makefile
CMakeLists.txt
pom.xml
build.gradle
settings.gradle

# Backup Files
backup
backups
backup.zip
backup.tar
backup.tar.gz
backup.sql
backup.rar
backup.7z
backup.old
backup~
db_backup
database_backup
dump.sql
export.sql
site.zip
www.zip
wwwroot.zip
web.zip
website.zip
temp
tmp
cache
old
back
bk
archive
archives

# Development Files
dev
develop
development
test
testing
tests
staging
stage
uat
qa
sandbox
alpha
beta
demo
prototype
debug
phpinfo.php
info.php
test.php
phpinfo
server-info
server-status
status
health
healthcheck
ping
heartbeat

# Upload Directories
upload
uploads
files
file
media
images
img
pics
pictures
assets
static
content
data
download
downloads
attachments
attachment
documents
docs
tmp
temp
cache
logs
log

# API Endpoints
api
apis
api/v1
api/v2
api/v3
rest
restful
graphql
graph
graphiql
playground
swagger
swagger-ui
api-docs
api-documentation
documentation
docs
v1
v2
v3
version
versions
endpoint
endpoints
webhook
webhooks
callback
callbacks
webapi
webservice
webservices
service
services
soap
wsdl
rpc
rss
feed
atom
json
xml
ajax

# Common CMS Paths
wp-admin
wp-content
wp-includes
wp-login.php
wp-config.php
xmlrpc.php
wp-json
wp-json/wp/v2/users
administrator
components
modules
plugins
themes
templates
includes
languages
locale
cache
tmp
logs

# Database
db
database
mysql
phpmyadmin
pma
myadmin
adminer
sql
sqlyog
dbadmin
mongodb
redis
memcache
memcached
elasticsearch
kibana
grafana
prometheus

# Monitoring & Metrics
metrics
stats
statistics
analytics
monitor
monitoring
status
health
healthcheck
readiness
liveness
probe
prometheus
metrics
actuator
actuator/health
actuator/info
actuator/metrics
actuator/env
actuator/beans
actuator/mappings

# JavaScript & Frontend
js
javascript
css
styles
style
scss
sass
less
fonts
font
webfonts
icons
images
img
pics
pictures
assets
static
public
dist
build
bundle
bundles
node_modules
bower_components
jspm_packages

# Error Pages
error
errors
404
403
500
502
503
error.html
404.html
403.html
500.html
error.php
404.php

# User Related
user
users
profile
profiles
account
accounts
member
members
customer
customers
client
clients
partner
partners
vendor
vendors
register
signup
join
subscribe
unsubscribe
newsletter
forgot
forgot-password
reset
reset-password
password
change-password
update-password
logout
signout
logoff

# Search
search
find
query
lookup
browse
filter
advanced-search
s
q
search.php
search.aspx
search.jsp

# Shopping/E-commerce
cart
basket
checkout
shop
store
products
product
item
items
catalog
category
categories
collections
orders
order
invoice
invoices
billing
payment
payments
shipping
tracking
wishlist
compare
reviews
rating

# Help & Support
help
support
faq
faqs
contact
contact-us
feedback
ticket
tickets
knowledge
knowledgebase
kb
wiki
docs
documentation
manual
guide
tutorial
howto
about
about-us
team
company
careers
jobs
press
news
blog
articles

# Security Related
security
secure
ssl
tls
certs
certificates
pki
ca
vault
secrets
keys
csp
csp-report
security.txt
.well-known
.well-known/security.txt
.well-known/openid-configuration
.well-known/assetlinks.json
.well-known/apple-app-site-association
.well-known/change-password