Wordlist Selection from Observed Stack
Build the smallest relevant corpus from observed framework, API, cloud, archive, JavaScript, and documentation evidence before sending requests.
Enter with artifacts, leave with evidence.
- observed framework
- API contract
- archive route family
- JavaScript operation names
- cloud deployment clue
- current scope
- observed stack evidence
- explicit request and rate budget
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Describe the observed surface
Record framework, server, API style, route shape, language, cloud, CMS, authentication, and evidence source before choosing words.
- current response evidence
- public artifacts
- stack evidence card
- Evidence gate
- Every stack label points to a response, script, contract, repository, or dated public source.
- Negative control
- Generic CDN and WAF fingerprints remain separate from origin stack evidence.
- Stop condition
- Do not select a corpus from branding or a single weak fingerprint.
Compose a compact corpus
Merge target terms from archives, JavaScript, docs, OpenAPI, GraphQL, products, careers, changelogs, and one source-linked framework list.
- stack evidence card
- approved public sources
- provenance-tagged words
- source counts
- Evidence gate
- Every word has a source class and normalization rule, and duplicates retain source counts.
- Negative control
- Password lists and unrelated technology families are excluded.
- Stop condition
- Do not publish target-specific corpora containing secrets or private identifiers.
Rank within the request budget
Score words by target occurrence, source diversity, route context, framework fit, recency, and cost, then set a hard request cap.
- provenance-tagged words
- rate rules
- ordered bounded corpus
- request plan
- Evidence gate
- The corpus size and order can be explained from observed evidence.
- Negative control
- A shuffled low-confidence sample is retained to measure selection bias without expanding the budget.
- Stop condition
- Stop if program automation rules or service stability do not permit the plan.
Feed results back into the corpus
Tag status, content type, redirect, soft-404 behavior, and distinctive response shape, then promote only meaningful new nouns and route families.
- bounded corpus
- known route and nonexistent controls
- result ledger
- refined corpus
- dead-word set
- Evidence gate
- A promoted result differs from wildcard and soft-404 controls and retains its source word.
- Negative control
- Known nonexistent paths establish the baseline response family.
- Stop condition
- Stop at the cap, on instability, or when results converge on a wildcard response.