Utilities
Join two wordlists into fuzzing candidates
Cartesian join of two wordlists for fuzzing candidates.
Go · MIT license
overview
What mgwls does
mgwls builds composite fuzzing tokens by pairing every line from a left wordlist with every line from a right list.
Pass files with -l and -r, set -delimiter between halves, or use -w with -side when one side is a single fixed word.
Trickest runs mgwls as a managed Utilities node: two lists in, FILE and FOLDER of merged lines out. Follow with duplicut before ffuf when the product repeats.
source github.com/trickest/mgwls
use cases
Where mgwls fits
Build name-plus-year candidates
Merge a list of base tokens with years or version suffixes so credential and path fuzzing covers dated variants in one pass.
Combine paths with extensions
Join directory stems with file extensions to produce upload and backup path candidates for content discovery.
Prefix or suffix a fixed word
Use -w and -side when one side is a single token (for example an environment name) applied across an entire wordlist.
Prepare a list for fuzzing
Generate the merged file, optionally dedupe it, and hand it to a fuzzer as the wordlist input for the next stage.
reference
mgwls inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| wordlist-one | FILE | -l | Left-hand wordlist file. |
| wordlist-two | FILE | -r | Right-hand wordlist file. |
| delimiter | STRING | -delimiter | String delimiter to place between words. |
| single-word | STRING | -w | Single word to use for concatenation instead of one list. |
| single-word-side | STRING | -side | Side for the single word: left or right. |
Showing key inputs. mgwls exposes 5 inputs in total.
example
Run mgwls
# merge base tokens with year suffixes for fuzzing candidates
mgwls -l bases.txt -r years.txt -delimiter ""admin2024
admin2025
api2024
api2025
dev2024
dev2025
staging2024
staging2025
www2024
www2025guidance
Choosing mgwls
Use mgwls when you need composite candidates from two lists before fuzzing. It merges; it does not clean or dedupe. Run clean-wordlist first for junk, duplicut after for repeats.
clean-wordlist
Cleans a single wordlist with regex passes. Run it before mgwls to trim noise, not to merge.
duplicut
Removes duplicates from a wordlist without sorting. Apply it to mgwls output when the cartesian product repeats.
mkpath
Builds URL paths from a wordlist. Overlaps for path prep but does not merge two lists.
faq
mgwls questions
related
More Utilities tools
browser-fetch
Headless Chromium render: requested URL, final URL, status, and title next to the page.
cewl
Spider a URL and return a wordlist for password crackers.
csvkit
SQL on one CSV. The table name is the file stem.
dnsgen
Wordlist and mined-word subdomain permutation.
duckdb
In-process SQL on CSV, JSON, and Parquet. No server.
edge-tts
Microsoft Edge neural speech from text or a script file. No API key.
Run mgwls yourself
Two wordlists feed mgwls, which merges every base word with every suffix and writes the combined list as a queryable output.
Facts on this page come from the live Trickest tool library.