ZeroTrace OSINT
Wordlist Generators
Generate custom dictionaries from text, sites, names, and patterns, for subdomain brute-forcing, password-list seeding, and fuzzing.
A handful of generators produce custom wordlists tailored to your target. The right wordlist often makes the difference between a brute-force that finds something and one that doesn't, generic lists like common.txt are useful as a baseline, but target-specific lists hit assets the generic lists miss.
Generators in this group
Username Generator
Generates handle candidates from a name (and optional birth year, optional known handles). Same engine as the username permutator in the People & Identity section. Useful as a generic dictionary for any tool that consumes username candidates.
Subdomain Wordlist Generator
Generates target-specific subdomain candidates. Configurable patterns:
| Pattern | Examples |
|---|---|
| Common environments | dev, staging, prod, test, beta, qa |
| Numbered envs | dev1 through dev9, env01 through env20 |
| Region prefixes | us-, eu-, ap-, de-, fr- |
| Service names | api, app, admin, auth, cdn, mail, vpn |
| Cross-product | api-dev, api-staging, app-eu, ... |
The output is the input to Gobuster (DNS mode) or to the toolkit's own subdomain discovery.
Wordlist Extractor
Extracts unique words from a source text or a URL. Configurable filters:
| Filter | Behaviour |
|---|---|
| Min / max length | Word-length bounds |
| Character class | Alpha-only, alphanum, allow-symbols |
| Frequency-sorted output | Most-frequent first |
| N-gram extraction | Bigrams, trigrams (combinations of adjacent words) |
| Per-page word source attribution | When extracting from a multi-page crawl, surfaces which page each word came from |
For password / passphrase candidate generation, the wordlist extractor over a target's website is one of the cheapest ways to seed a list with target-relevant terms (product names, internal jargon, employee names from public bios, etc.).
Wordlist generation is harmless. Wordlist use in brute-force attacks generates real traffic against the target. Use generated lists only against assets you own or are authorised to test.
Cross-tool composition
The wordlist generators feed:
- Gobuster builder, directory and DNS modes.
- Sublist3r builder, brute-force pass.
- The toolkit's subdomain discovery wordlist enumeration.
- The toolkit's username search, username candidates.
- The toolkit's email permutator, local-part candidates.
Each generator's output exports as plain text, one entry per line, ready to drop into any of the consumers.
Pivots
The generators do not pivot, they produce candidates. The pivots come from running the candidates through the next tool.
Sources
- All generators run locally.
- The wordlist extractor's URL-mode fetches the target URL directly (rate-limited).
- No external API is queried.