# Pentesting focused virtual hosts wordlist
# Based on common pentesting targets and CTF challenges

# Common pentesting targets
admin.%s
administrator.%s
root.%s
test.%s
demo.%s
dev.%s
staging.%s
beta.%s
alpha.%s
backup.%s
old.%s
legacy.%s
archive.%s

# Authentication & Access Control  
auth.%s
login.%s
signin.%s
sso.%s
oauth.%s
ldap.%s
ad.%s
radius.%s
kerberos.%s

# File access and uploads
files.%s
upload.%s
uploads.%s
download.%s
downloads.%s
ftp.%s
sftp.%s
share.%s
shared.%s
public.%s
private.%s

# Databases and data
db.%s
database.%s
data.%s
sql.%s
mysql.%s
postgres.%s
oracle.%s
mssql.%s
mongodb.%s
elasticsearch.%s
phpmyadmin.%s
adminer.%s

# Development and debugging
debug.%s
trace.%s
log.%s
logs.%s
error.%s
errors.%s
exception.%s
dump.%s
backup.%s
git.%s
svn.%s
source.%s

# Management interfaces
manage.%s
manager.%s
management.%s
console.%s
dashboard.%s
panel.%s
control.%s
cpanel.%s
plesk.%s
whm.%s

# APIs and services
api.%s
rest.%s
soap.%s
graphql.%s
webhook.%s
service.%s
services.%s
microservice.%s
gateway.%s

# Internal services
internal.%s
intranet.%s
private.%s
secure.%s
secret.%s
hidden.%s
restricted.%s
confidential.%s

# Infrastructure
proxy.%s
lb.%s
loadbalancer.%s
cache.%s
redis.%s
memcache.%s
cdn.%s
mirror.%s

# Monitoring and metrics
monitor.%s
monitoring.%s
metrics.%s
stats.%s
analytics.%s
grafana.%s
prometheus.%s
nagios.%s
zabbix.%s

# Security tools
scanner.%s
vulnerability.%s
vuln.%s
security.%s
pentest.%s
audit.%s
compliance.%s

# Common CTF patterns
flag.%s
ctf.%s
challenge.%s
game.%s
puzzle.%s
secret.%s
treasure.%s
key.%s

# Vulnerable applications (for testing)
dvwa.%s
webgoat.%s
mutillidae.%s
bwapp.%s
juice.%s
vulnhub.%s

# WordPress specific
wp.%s
wordpress.%s
blog.%s
cms.%s

# Common ports as subdomains  
port80.%s
port443.%s
port8080.%s
port8443.%s
port3000.%s
port8000.%s

# Single word targets (no %s)
admin
administrator  
root
test
demo
dev
staging
beta
alpha
backup
old
legacy
archive
debug
trace
log
logs
error
errors
manage
manager
console
dashboard
panel
api
internal
intranet
private
secure
secret
hidden
monitor
stats
scanner
security
flag
ctf
dvwa
webgoat
wp
wordpress
