Home/ MITRE Matrix/ Reconnaissance/ T1595.003

T1595.003Wordlist Scanning

T1595.003 — Wordlist Scanning is a MITRE ATT&CK technique in the Reconnaissance tactic. Clankerusecase tracks 3 detection use cases covering it and 4 threat-intel articles citing it.

Reconnaissance

View on the matrix → Filter Detection Library MITRE official spec ↗

3Use cases

4Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1595 · Active Scanning

Use cases covering this technique (3)

[LLM] Flowise OAuth2 credentialId enumeration (mixed 200/404 probing) Bespoke recon · alerting SP [LLM] Host header fuzzing burst against Poweradmin auth endpoints from single source Bespoke recon · alerting SP [LLM] FacturaScripts filter[] SQLi column-count / schema enumeration (burst probing) Bespoke exploit · hunting SP

Articles citing this technique (4)

crit [GHSA / CRITICAL] CVE-2026-70478: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any art-121

crit [GHSA / CRITICAL] CVE-2026-54588: Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construct art-186

crit [GHSA / CRITICAL] CVE-2026-45262: FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesi art-274

crit Webworm: New burrowing techniques art-459