Skip to content

feat(cli): allow repeating -w to combine wordlists - #211

Closed
nova-loop wants to merge 1 commit into
TMHSDigital:mainfrom
nova-loop:feat/multi-wordlist
Closed

nova-loop wants to merge 1 commit into
TMHSDigital:mainfrom
nova-loop:feat/multi-wordlist

Conversation

@nova-loop

Copy link
Copy Markdown

Description

-w can now be repeated, so you can layer a general list and a target-specific one without concatenating them by hand:

subenum -w general.txt -w target.txt example.com
  • -w is a flag.Value slice (wordlistPaths in main_wordlist.go). readWordlist reads each file in order and concatenates the lines before wordlist.Prepare, so an entry that appears in more than one list is scanned once and counted in duplicates, the same way as within one file.
  • - (stdin) stays valid as one of the entries. Two - entries are rejected ("standard input can only be read once"), and so is -w - together with -dL -, as before.
  • Config file / SUBENUM_W: these still take a single path. Each is a default, so the next source replaces it rather than adding to it: env replaces config, and the first -w on the command line replaces both. This keeps the existing flag > env > config precedence. Otherwise SUBENUM_W=a.txt subenum -w b.txt would silently scan both lists. This works through a small markDefault() hook that defaultsLoader.apply calls after setting a value.
  • Resume: inputDigests fingerprints every -w file, and runs that read stdin through any -w - still don't save resume state.
  • Verbose Wordlist: and the "no valid entries" error list all the paths.
  • Docs: README flag table, the regenerated docs/_includes/flags.md (-w <file>, usage text), a one-line note in docs/ARCHITECTURE.md, and a CHANGELOG entry under Unreleased / Added. Shell completions and the man page are generated from the FlagSet, so they pick up the new usage text, and -w was already in fileFlags.

Related Issue

Closes #199

Type of Change

  • New feature (non-breaking change which adds functionality)

A single -w behaves exactly as before. In -h the flag now shows as -w file instead of -w string.

Checklist

  • I have read the CONTRIBUTING document
  • My code follows the code style of this project
  • I have added/updated appropriate comments to the code
  • I have added tests that prove my fix is effective or that my feature works (main_wordlist_test.go): -w a -w b end to end with an overlapping entry scanned once, a file plus - from stdin, rejected inputs (two -, -w - with -dL -, one missing file), config/env/flag replacement, and flag parsing across the domain argument
  • New and existing unit tests pass locally with my changes (go test ./... -shuffle=on, go vet ./..., gofmt)
  • I have updated the documentation accordingly (README, flags include, ARCHITECTURE, CHANGELOG)

I didn't run make lint because golangci-lint isn't installed in my environment, so CI's lint job covers that.

Ethical Considerations

  • This change maintains or improves the security controls in the tool
  • This change follows the educational/legitimate security testing focus of the project
  • I have considered potential misuse cases and taken appropriate steps to prevent them (input-handling change only; no new network behaviour)

Additional Information

The config file still accepts only a string for w. I didn't add w to listFlags, because those values are joined with commas and a path can contain a comma. If you'd like config-file lists of wordlists, that could be a follow-up with its own separator rule.

AI assistance: This change was prepared with AI assistance. An AI coding assistant wrote the code, tests and doc updates from the issue. Before opening the PR I reviewed the diff and ran the checks listed above.

-w is now a repeatable flag. The files are read in order and their lines
concatenated before Prepare, so an entry in more than one list is scanned
once. '-' stays valid as one entry (once). A config-file or SUBENUM_W
value is a default that the command line replaces rather than extends.

Closes TMHSDigital#199

Signed-off-by: nova-loop <[email protected]>
TMHSDigital pushed a commit that referenced this pull request Nov 10, 2026
-w is now a repeatable flag.Value. The files are read in order and their
lines concatenated before wordlist.Prepare, so an entry found in more than
one list is scanned once and counted as a duplicate. "-" stays valid as one
entry (at most once, and not together with -dL -). A config-file or
SUBENUM_W value is a default that the first -w on the command line
replaces, keeping flag > env > config precedence. Resume fingerprints every
-w file.

Squash of #211, rebased onto main (CHANGELOG conflict with #196 resolved).

Fixes #199
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01LpkeXSPwrzd7ZCuX3no7gD
@TMHSDigital

Copy link
Copy Markdown
Owner

Thanks, this is a clean change, and the config/env replace-not-extend handling plus the stdin edge cases are well thought through.

main moved underneath this PR (#196 landed and also added a CHANGELOG line), so I applied your change as a squash on main with you as the commit author, after resolving that one CHANGELOG conflict: f2cde07. The full suite (go test -race -shuffle=on ./...), go vet and golangci-lint (0 issues) pass on the result. Closing this PR since its content is now on main, and #199 is closed by the commit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Allow multiple -w wordlists

2 participants