loading
Loading content
loading
Utilities
Cartesian join of two wordlists for fuzzing candidates.
overview
mgwls builds composite fuzzing tokens by pairing every line from a left wordlist with every line from a right list.
Pass files with -l and -r, set -delimiter between halves, or use -w with -side when one side is a single fixed word.
Trickest runs mgwls as a managed Utilities node: two lists in, FILE and FOLDER of merged lines out. Follow with duplicut before ffuf when the product repeats.
source github.com/trickest/mgwls
use cases
Merge a list of base tokens with years or version suffixes so credential and path fuzzing covers dated variants in one pass.
Join directory stems with file extensions to produce upload and backup path candidates for content discovery.
Use -w and -side when one side is a single token (for example an environment name) applied across an entire wordlist.
Generate the merged file, optionally dedupe it, and hand it to a fuzzer as the wordlist input for the next stage.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| wordlist-one | FILE | -l | Left-hand wordlist file. |
| wordlist-two | FILE | -r | Right-hand wordlist file. |
| delimiter | STRING | -delimiter | String delimiter to place between words. |
| single-word | STRING | -w | Single word to use for concatenation instead of one list. |
| single-word-side | STRING | -side | Side for the single word: left or right. |
Showing key inputs. mgwls exposes 5 inputs in total.
example
# merge base tokens with year suffixes for fuzzing candidatesmgwls -l bases.txt -r years.txt -delimiter ""admin2024admin2025api2024api2025dev2024dev2025staging2024staging2025www2024www2025guidance
Use mgwls when you need composite candidates from two lists before fuzzing. It merges; it does not clean or dedupe. Run clean-wordlist first for junk, duplicut after for repeats.
Cleans a single wordlist with regex passes. Run it before mgwls to trim noise, not to merge.
Removes duplicates from a wordlist without sorting. Apply it to mgwls output when the cartesian product repeats.
Builds URL paths from a wordlist. Overlaps for path prep but does not merge two lists.
faq
related
Spider a URL and return a wordlist for password crackers.
Wordlist and mined-word subdomain permutation.
Import, export, and upsert workflow data against an Airtable base.
Decode Android APK files into smali sources and resources.
Check a file's values against conditions and exit with a matching code.
Authenticated Route53 hosted-zone inventory.
Two wordlists feed mgwls, which merges every base word with every suffix and writes the combined list as a queryable output.
Facts on this page come from the live Trickest tool library.