Add common Swagger/OpenAPI endpoints to reconnaissance wordlists

[notReallySouvik]

Description

While exploring the modules, I noticed that Swagger/OpenAPI is currently only detected through passive technology fingerprinting in web_technologies.yaml (for example detecting swagger-ui-bundle.js).

However, many applications expose Swagger/OpenAPI documentation through predictable endpoints that are commonly used during reconnaissance, such as:

• /swagger-ui.html
• /swagger
• /swagger-ui/
• /api-docs
• /v3/api-docs
• /swagger.json
• /openapi.json

These endpoints can sometimes expose full API schemas and unauthenticated routes.

Proposal

Add these common Swagger/OpenAPI paths to the payload wordlists used by modules such as:

• dir_scan
• config_scan

This would allow the scanner to actively probe for exposed API documentation endpoints instead of relying only on passive fingerprinting.

Benefits

• Expands API reconnaissance coverage
• Helps identify exposed API documentation
• May reveal unauthenticated API endpoints during recon

Implementation

This should be a relatively small change by extending the relevant wordlists with the endpoints listed above.

If this approach looks good, I’d be happy to work on implementing it.

[notReallySouvik]

I'd like to work on this if it sounds good.

[ChrisJr404]

Hi @arkid15r — I drafted a PR for this in #1542 (added 28 Swagger / OpenAPI / Redoc paths to dir_wordlist.txt per the spec in this issue) but the auto-checker closed it because I'm not assigned. @notReallySouvik mentioned interest back in March but I didn't see a follow-up PR over the last 7 weeks; if you're OK assigning this to me I'll reopen #1542 right away. Otherwise happy to step aside.