Finding the Needle in the Haystack with Dicozorus - A New Companion for Advanced Web Fuzzing

Comments, chapters, ... Slides Transcript Search
Loading Click here to add:
Subscribe to notifications

When subscribed to notifications, an email will be sent to you for all added annotations.

Your user account has no email address.

Information on this media

26 views

URL fuzzing is a critical step in penetration testing, yet its effectiveness often hinges on the quality of wordlists. Publicly available lists frequently suffer from missing critical entries, poor sorting, lack of modularity, and irrelevant content, leading to inefficient scans and missed vulnerabilities. This talk introduces a methodology for building better wordlists, along with a tool, Dicozorus, designed to support this process by providing a robust system for generating, managing, and curating high-quality fuzzing wordlists. Dicozorus relies on a database that stores entries with rich metadata (severity, type, category, tags, references), enabling the creation of tailored wordlists based on context such as scope, network performance, or stealth requirements. Used internally for over five years, it has significantly improved wordlist quality and revealed numerous critical vulnerabilities absent from popular lists. Dicozorus provides both a curated compilation of entries for immediate use as well as the ability for professionals to maintain custom, effective datasets. The tool will be made publicly available on Synacktiv’s GitHub repository ahead of the conference.

Creation date: June 30, 2026
Speakers: Vincent Herbulot (Security Researcher, Synacktiv)
License: CC BY-SA v4
Links:

Other media in the channel "2026"