loading
loading
Utilities
A small Go script that merges two wordlists into combined entries.
overview
mgwls is a small Go utility that merges two wordlists into combined entries, pairing every line from the left list with every line from the right. That cartesian join is the usual way to build composite candidates such as name plus year, base path plus extension, or company stem plus environment suffix before a fuzzer runs.
Point -l and -r at the two files, or use -w with -side when one side is a single fixed word instead of a list. -delimiter sets the string placed between the halves, so you can join with nothing, a dash, a dot, or any other separator your attack surface expects.
On Trickest, mgwls is a Utilities node that takes two wordlists and writes a file and folder of merged lines. Run it before ffuf or a similar fuzzer, and follow with duplicut when you need to strip duplicate composites.
source github.com/trickest/mgwls
use cases
Merge a list of base tokens with years or version suffixes so credential and path fuzzing covers dated variants in one pass.
Join directory stems with file extensions to produce upload and backup path candidates for content discovery.
Use -w and -side when one side is a single token (for example an environment name) applied across an entire wordlist.
Generate the merged file, optionally dedupe it, and hand it to a fuzzer as the wordlist input for the next stage.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| wordlist-one | FILE | -l | Left-hand wordlist file. |
| wordlist-two | FILE | -r | Right-hand wordlist file. |
| delimiter | STRING | -delimiter | String delimiter to place between words. |
| single-word | STRING | -w | Single word to use for concatenation instead of one list. |
| single-word-side | STRING | -side | Side for the single word: left or right. |
Showing key inputs. mgwls exposes 5 inputs in total.
example
# merge base tokens with year suffixes for fuzzing candidatesmgwls -l bases.txt -r years.txt -delimiter ""admin2024admin2025api2024api2025dev2024dev2025staging2024staging2025www2024www2025guidance
Reach for mgwls when you need to combine two wordlists into composite candidates before fuzzing. To strip duplicates from the result use duplicut, and to scrub junk lines first use clean-wordlist.
Cleans a single wordlist with regex passes. Run it before mgwls to trim noise, not to merge.
Removes duplicates from a wordlist without sorting. Useful on the merged output mgwls produces.
Builds URL paths from a wordlist. Overlaps for path generation but does not merge two lists.
faq
related
Import, export, and link workflow data with Airtable.
Decode Android APK files into smali sources and resources.
Check a file's values against conditions and exit with a matching code.
Extract all hosted zones from AWS Route53.
Output file lines by batch size, given START_LINE and END_LINE.
Extract a batch range from a file's lines or a folder's files, with parallel processing.
Two wordlists feed mgwls, which merges every base word with every suffix and writes the combined list as a queryable output.
Facts on this page come from the live Trickest tool library.