ZeroTrace OSINT
Wordlist Generators
Generate custom dictionaries from text, sites, names, and patterns — for subdomain brute-forcing, password-list seeding, and fuzzing.
A handful of generators produce custom wordlists tailored to your target. The right wordlist often makes the difference between a brute-force that finds something and one that doesn't — generic lists like common.txt are useful as a baseline, but target-specific lists hit assets the generic lists miss.
Generators in this group
Username Generator
Generates handle candidates from a name (and optional birth year, optional known handles). Same engine as the username permutator in the People & Identity section. Useful as a generic dictionary for any tool that consumes username candidates.
Subdomain Wordlist Generator
Generates target-specific subdomain candidates. Configurable patterns:
| Pattern | Examples |
|---|---|
| Common environments | dev, staging, prod, test, beta, qa |
| Numbered envs | dev1 through dev9, env01 through env20 |
| Region prefixes | us-, eu-, ap-, de-, fr- |
| Service names | api, app, admin, auth, cdn, mail, vpn |
| Cross-product | api-dev, api-staging, app-eu, ... |
The output is the input to Gobuster (DNS mode) or to the toolkit's own subdomain discovery.
Wordlist Extractor
Extracts unique words from a source text or a URL. Configurable filters:
| Filter | Behaviour |
|---|---|
| Min / max length | Word-length bounds |
| Character class | Alpha-only, alphanum, allow-symbols |
| Frequency-sorted output | Most-frequent first |
| N-gram extraction | Bigrams, trigrams (combinations of adjacent words) |
| Per-page word source attribution | When extracting from a multi-page crawl, surfaces which page each word came from |
For password / passphrase candidate generation, the wordlist extractor over a target's website is one of the cheapest ways to seed a list with target-relevant terms (product names, internal jargon, employee names from public bios, etc.).
Wordlist generation is harmless. Wordlist use in brute-force attacks generates real traffic against the target. Use generated lists only against assets you own or are authorised to test.
Cross-tool composition
The wordlist generators feed:
- Gobuster builder — directory and DNS modes.
- Sublist3r builder — brute-force pass.
- The toolkit's subdomain discovery wordlist enumeration.
- The toolkit's username search — username candidates.
- The toolkit's email permutator — local-part candidates.
Each generator's output exports as plain text, one entry per line, ready to drop into any of the consumers.
Pivots
The generators do not pivot — they produce candidates. The pivots come from running the candidates through the next tool.
Sources
- All generators run locally.
- The wordlist extractor's URL-mode fetches the target URL directly (rate-limited).
- No external API is queried.