From 5a80e85c572d3c29ab72faef10e63c2330451175 Mon Sep 17 00:00:00 2001
From: Anup Das <149822306+anupddas@users.noreply.github.com>
Date: Sat, 4 Jul 2026 11:14:02 +0530
Subject: [PATCH 1/2] Update wordlist with new categories and keywords
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removed several entries and added new categories with associated keywords to the wordlist.

CI/CD and IaC terms are added because these buckets, when exposed, tend to leak far more sensitive material (state files with secrets, build artifacts with embedded credentials) than the generic assets/uploads style buckets already in the list — and they're a growing pattern as more orgs adopt Terraform/K8s.

Analytics/data pipeline terms reflect how companies commonly name buckets tied to Segment, Kinesis Firehose, and internal BI tooling — a category missing from the current list entirely.

Secrets/credentials terms are intentionally included even though they sound alarming — they're standard in every major wordlist (SecLists, cloud_enum, etc.) precisely because misconfigured buckets with these exact names are a recurring, real-world finding that defenders and bug bounty hunters need to check for.

I avoided adding highly specific company/product names to keep the list broadly applicable rather than tailored to one vendor.
---
 examples/wordlist.txt | 476 +++++++++++++++++++++++++++---------------
 1 file changed, 308 insertions(+), 168 deletions(-)

diff --git a/examples/wordlist.txt b/examples/wordlist.txt
index 870e50c..412e7fa 100644
--- a/examples/wordlist.txt
+++ b/examples/wordlist.txt
@@ -1,36 +1,46 @@
-ab
-apt
-resource
-resources
-us
-hub
-lab
-labs
-event
-events
+# --- Analytics / Data Pipelines ---
+
+analytics
+bi
+data-lake
+datalake
+etl
+etl-jobs
 export
-mobile
-splunk
 exports
-main
-main-storage
-config
-configs
-api-config
-api-configs
-vm
-vms
-registry
-git
-docker
-docker-registry
-ad
-ads
-any
-api
+firehose
+kinesis
+kinesis-firehose
+segment
+segment-logs
+warehouse-raw
+
+# --- Application / Frontend / Web ---
+
 app
 app-img
 apps
+frontend
+html
+landing
+page
+pages
+site
+sites
+ui
+web
+webapp
+website
+websites
+widget
+widgets
+wordpress
+wp
+www
+wwwcache
+
+# --- Assets / Media / Content ---
+
 asset
 assetmanager
 assets
@@ -38,193 +48,323 @@ attachment
 attachments
 avatar
 avatars
-aws
-aws-logs
-awslogs
-backup
-backups
 banner
 banners
-beta
-billing
-invoices
-invoice
-binaries
 blog
 blog-assets
 blogs
-bucket
-builds
-bulletins
-cache
-caches
 catalogue
-cc
-cdn
-cloud
-cloudfront
-cloudtrail
-cloudtrail-logs
-cloudtraillog
-cloudtraillogs
-cloudtrails
-code-repo
 content
 contents
+galleries
+gallery
+images
+img
+imgs
+media
+media-downloads
+media-uploads
+mediadownloads
+photo
+photos
+picture
+pictures
+profile-photo
+profile-photos
+theme
+themekit
+themes
+upload
+uploads
+user-asset
+user-assets
+usercontent
+video
+videos
+
+# --- Backups / Snapshots / Dumps ---
+
+backup
+backups
+data_dump
+data_dumps
+dump
+snapshot
+snapshots
+
+# --- Business / Customer / Marketing ---
+
+ad
+ads
+billing
 customers
+invoice
+invoices
+marketing
+marketing_assets
+newsletter
+partner
+partners
+rates
+retail
+retailer
+retailers
+shop
+shops
+store
+
+# --- CI/CD & Build Artifacts ---
+
+actions-cache
+artifact
+artifacts
+buildkite
+builds
+ci
+ci-artifacts
+ci-cache
+circleci
+github-actions
+gitlab-ci
+jenkins
+jenkins-artifacts
+pipeline
+pipelines
+
+# --- Cloud / AWS / Infrastructure ---
+
+aws
+cloud
+cloudfront
+elasticache
+elasticbeanstalk
+ha
+infra
+ops
+resource
+resources
+s3
+vm
+vms
+vps
+
+# --- Configuration / Settings ---
+
+api-config
+api-configs
+config
+configs
+
+# --- Data / Databases / Storage ---
+
+bucket
 data
 data-warehouse
-data_dump
-data_dumps
 dataset
 datasets
 datawarehouse
 db
-desk
+file
+files
+main
+main-storage
+share
+shared
+storage
+warehouse
+
+# --- Development / Source Code ---
+
+api
+code-repo
 devcenter
+deveopers
 developer
 development
-deveopers
+git
+repo
+repositories
+repository
+studio
+
+# --- Distributions / Packages / Releases ---
+
+apt
+binaries
 dist
 distribution
 distributions
 distro
 dl
-doc
-docs
-documentation
 download
 downloads
 driver
 drivers
-dump
 editions
-elasticache
-elasticbeanstalk
-email
-emails
-file
-files
-forum
-forums
-frontend
-galleries
-gallery
-ha
-help
-html
-images
-img
-imgs
-infra
-internal
-landing
-log
-logs
-mail
-mails
-marketing
-marketing_assets
-media
-media-downloads
-media-uploads
-mediadownloads
-misc
-net
-newsletter
-ops
-page
-pages
-partner
-partners
-pdf
-pdfs
-photo
-photos
-picture
-pictures
+package
+packages
 prerelease
 prereleases
+releases
+update
+updates
+
+# --- Documents / Documentation ---
+
+doc
+docs
+documentation
+pdf
+pdfs
+
+# --- Environments (Dev/Test/Prod) ---
+
+beta
+internal
 private
-profile-photo
-profile-photos
-ps
+prod
 public
 qa
-rates
-releases
-repo
-repositories
-repository
-retail
-retailer
-retailers
-s3
-tools
+sandbox
+stage
+test
+test-sandbox
+
+# --- Infrastructure as Code / State ---
+
+ansible
+cfn-templates
+cloudformation
+packer
+packer-images
+state
+state-files
+terraform
+terraform-state
+tf-state
+tfstate
+
+# --- Kubernetes / Container Tooling ---
+
+docker
+docker-registry
+eks
+eks-logs
+helm
+helm-charts
+k8s
+kube-config
+kubeconfig
+kubernetes
+registry
+
+# --- Logs / Monitoring ---
+
+aws-logs
+awslogs
+cloudtrail
+cloudtrail-logs
+cloudtraillog
+cloudtraillogs
+cloudtrails
+log
+logs
 s3-log
 s3-logs
 s3log
 s3logs
-scdn
-share
-shared
-shop
-shops
 signal
 signals
-site
-sites
 sitestats
-test
-test-sandbox
-sandbox
-snapshot
-snapshots
+splunk
+
+# --- Misc frequently observed in public disclosures ---
+
+ab
+any
+archive
+archives
+audit
+audit-logs
+cc
+compliance
+event
+events
+exports-daily
+exports-weekly
+hub
+lab
+labs
+legacy
+map
+migration
+migrations
+misc
+net
+ps
+sandbox-data
+search
 sp
-stage
+staging-data
+training
+ts
+us
+
+# --- Mobile / CDN / Static Delivery ---
+
+android
+apk
+apk-releases
+cdn
+cdn-assets
+cdn-static
+edge-cache
+ios
+ipa
+mobile
+mobile-assets
+scdn
 static
-storage
-search
-map
-store
-studio
-prod
+static-cdn
+
+# --- Secrets / credentials (high-value targets, include for defensive coverage) ---
+
+certificates
+certs
+credentials
+dotenv
+env
+keys
+secrets
+ssl
+ssl-certs
+
+# --- Support / Helpdesk / Communications ---
+
+bulletins
+desk
+email
+emails
+forum
+forums
+help
+mail
+mails
 submission
 submissions
 support
+zendesk
+
+# --- Temporary / Cache ---
+
+cache
+caches
 temp
 temporary
-theme
-themekit
-themes
 tmp
+
+# --- Tools / Utilities ---
+
 toolbelt
-training
-ts
-ui
-update
-updates
-upload
-uploads
-user-asset
-user-assets
-usercontent
+tools
 vagrant
-video
-videos
-vps
-warehouse
-web
-webapp
-website
-websites
-widget
-widgets
-wordpress
-wp
-www
-wwwcache
-zendesk
-package
-packages
-distro

From 717f6e5be89a0596a211d778b62df4cead8fd6c6 Mon Sep 17 00:00:00 2001
From: Anup Das <149822306+anupddas@users.noreply.github.com>
Date: Sat, 4 Jul 2026 11:15:46 +0530
Subject: [PATCH 2/2] Expand suffixlist.txt with new suffixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added additional suffixes to the suffix list.

Environment suffixes (-prod, -dev, -staging, -uat) are the single highest-value category in real bucket-squatting/discovery reports — organizations very consistently create parallel buckets per environment.

Region suffixes (-east, -west, -eu) reflect how multi-region deployments often duplicate a base bucket name per region.
Year suffixes catch buckets created for annual snapshots/exports/campaigns, a pattern seen often in marketing/data-export buckets.

I deliberately kept numeric suffixes short (v1, v2, 01, 02) rather than an exhaustive numeric range, since the tool already does prefix/suffix combination — an overly large suffix list multiplies total DNS queries linearly and works against the tool's stated "stealthy" design goal.
---
 examples/suffixlist.txt | 47 ++++++++++++++++++++++++++++++++++-------
 1 file changed, 39 insertions(+), 8 deletions(-)

diff --git a/examples/suffixlist.txt b/examples/suffixlist.txt
index d548615..3fc89ad 100644
--- a/examples/suffixlist.txt
+++ b/examples/suffixlist.txt
@@ -1,8 +1,39 @@
-dev
-development
-live
-stag
-staging
-prod
-production
-test
+-prod
+-production
+-dev
+-development
+-stage
+-staging
+-test
+-testing
+-qa
+-uat
+-demo
+-sandbox
+-internal
+-external
+-public
+-private
+-old
+-new
+-backup
+-bak
+-archive
+-tmp
+-temp
+-v1
+-v2
+-01
+-02
+-east
+-west
+-eu
+-us
+-apac
+-2020
+-2021
+-2022
+-2023
+-2024
+-2025
+-2026