From a46315b1ecd6b8d2181f769c6925512f1ed5e8de Mon Sep 17 00:00:00 2001
From: Steve Pinkham <steve.pinkham@gmail.com>
Date: Sat, 17 Mar 2012 09:59:08 -0400
Subject: [PATCH] 2.04b: See changelog or extended commit message

- Option -V eliminated in favor of -W / -S.
- Option -l added to limit the maximum requests per second
  (contributed by Sebastian Roschke)
- Option -k added to limit the maximum duration of a scan (contributed
  by Sebastian Roschke)
- Support for #ro, -W-; related documentation changes.
- HTTPS -> HTTP form detection.
- Added more diverse traversal and file disclosure tests (including
  file:// scheme tests)
- Improved injection detection in <script> sections, where a ' or "
  is all we need to inject js code.
- Added check to see if our injection strings end up server
  Set-Cookie,
  Set-Cookie2 and Content-Type reponse headers
- URLs that give us a Javascript response are now tested with a
  "callback=" parameter to find JSONP issues.
- Fixed "response varies" bug in 404 detection where a stable page
  would be marked unstable.
- Bugfix to es / eg handling in dictionaries.
- Added the "complete-fast.wl" wordlist which is an es / eg optimized
  version of "complete.wl" (resulting in 20-30% fewer requests).
---
 ChangeLog                       |   32 +
 Makefile                        |    2 +-
 README                          |   72 +-
 analysis.c                      |   64 +-
 analysis.h                      |   12 +-
 assets/index.html               |    2 +
 config.h                        |   13 +-
 crawler.c                       |  168 ++-
 crawler.h                       |   24 +-
 database.c                      |   77 +-
 database.h                      |    9 +-
 dictionaries/README-FIRST       |  111 +-
 dictionaries/complete-fast.wl   | 2167 +++++++++++++++++++++++++++++++
 dictionaries/complete.wl        |    1 +
 dictionaries/extensions-only.wl |    1 +
 dictionaries/medium.wl          |    1 +
 dictionaries/minimal.wl         |    1 +
 dictionaries/test.wl            |    5 +
 http_client.c                   |   53 +-
 http_client.h                   |   20 +-
 report.c                        |    4 +-
 skipfish.1                      |   23 +-
 skipfish.c                      |  101 +-
 23 files changed, 2744 insertions(+), 219 deletions(-)
 create mode 100644 dictionaries/complete-fast.wl
 create mode 100644 dictionaries/test.wl

diff --git a/ChangeLog b/ChangeLog
index b642850..a90ccf8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,35 @@
+Version 2.04b:
+--------------
+
+  - Option -V eliminated in favor of -W / -S.
+
+  - Option -l added to limit the maximum requests per second (contributed by Sebastian Roschke)
+
+  - Option -k added to limit the maximum duration of a scan (contributed by Sebastian Roschke)
+
+  - Support for #ro, -W-; related documentation changes.
+
+  - HTTPS -> HTTP form detection.
+
+  - Added more diverse traversal and file disclosure tests (including file:// scheme tests)
+
+  - Improved injection detection in <script> sections, where a ' or "
+    is all we need to inject js code.
+
+  - Added check to see if our injection strings end up server Set-Cookie,
+    Set-Cookie2 and Content-Type reponse headers
+
+  - URLs that give us a Javascript response are now tested with a
+    "callback=" parameter to find JSONP issues.
+
+  - Fixed "response varies" bug in 404 detection where a stable page would be marked unstable.
+
+  - Bugfix to es / eg handling in dictionaries.
+
+  - Added the "complete-fast.wl" wordlist which is an es / eg optimized
+    version of "complete.wl" (resulting in 20-30% fewer requests).
+
+
 Version 2.03b:
 --------------
 
diff --git a/Makefile b/Makefile
index c5f11a9..048debc 100644
--- a/Makefile
+++ b/Makefile
@@ -20,7 +20,7 @@
 #
 
 PROGNAME   = skipfish
-VERSION    = 2.03b
+VERSION    = 2.04b
 
 OBJFILES   = http_client.c database.c crawler.c analysis.c report.c
 INCFILES   = alloc-inl.h string-inl.h debug.h types.h http_client.h \
diff --git a/README b/README
index 8def8c9..ed6a707 100644
--- a/README
+++ b/README
@@ -4,8 +4,14 @@ skipfish - web application security scanner
 
   http://code.google.com/p/skipfish/
 
-  * Written and maintained by Michal Zalewski <lcamtuf@google.com>.
-  * Copyright 2009, 2010, 2011 Google Inc, rights reserved.
+  * Written and maintained by:
+
+      Michal Zalewski <lcamtuf@google.com>
+      Niels Heinen <heinenn@google.com>
+      Sebastian Roschke <s.roschke@googlemail.com>
+
+  * Copyright 2009 - 2012 Google Inc, rights reserved.
+
   * Released under terms and conditions of the Apache License, version 2.0.
 
 --------------------
@@ -111,7 +117,7 @@ A rough list of the security checks offered by the tool is outlined below.
     * Stored and reflected XSS vectors in document body (minimal JS XSS support).
     * Stored and reflected XSS vectors via HTTP redirects.
     * Stored and reflected XSS vectors via HTTP header splitting.
-    * Directory traversal / RFI (including constrained vectors).
+    * Directory traversal / LFI / RFI (including constrained vectors).
     * Assorted file POIs (server-side sources, configs, etc).
     * Attacker-supplied script and CSS inclusion vectors (stored and reflected).
     * External untrusted script and CSS inclusion vectors.
@@ -130,6 +136,7 @@ A rough list of the security checks offered by the tool is outlined below.
     * Attacker-supplied embedded content (stored and reflected).
     * External untrusted embedded content.
     * Mixed content on non-scriptable subresources (optional).
+    * HTTPS -> HTTP submission of HTML forms (optional).
     * HTTP credentials in URLs.
     * Expired or not-yet-valid SSL certificates.
     * HTML forms with no XSRF protection.
@@ -228,20 +235,25 @@ behavior there.
 To compile it, simply unpack the archive and try make. Chances are, you will
 need to install libidn first.
 
-Next, you need to copy the desired dictionary file from dictionaries/ to
-skipfish.wl. Please read dictionaries/README-FIRST carefully to make the
-right choice. This step has a profound impact on the quality of scan results
-later on.
+Next, you need to read the instructions provided in dictionaries/README-FIRST
+to select the right dictionary file and configure it correctly. This step has a 
+profound impact on the quality of scan results later on, so don't skip it.
 
-Once you have the dictionary selected, you can try:
+Once you have the dictionary selected, you can use -S to load that dictionary,
+and -W to specify an initially empty file for any newly learned site-specific
+keywords (which will come handy in future assessments):
 
-$ ./skipfish -o output_dir http://www.example.com/some/starting/path.txt
+$ touch new_dict.wl
+$ ./skipfish -o output_dir -S existing_dictionary.wl -W new_dict.wl \
+  http://www.example.com/some/starting/path.txt
+
+You can use -W- if you don't want to store auto-learned keywords anywhere.
 
 Note that you can provide more than one starting URL if so desired; all of
 them will be crawled. It is also possible to read URLs from file, using
 the following syntax:
 
-$ ./skipfish -o output_dir @../path/to/url_list.txt
+$ ./skipfish [...other options...] @../path/to/url_list.txt
 
 The tool will display some helpful stats while the scan is in progress. You
 can also switch to a list of in-flight HTTP requests by pressing return.
@@ -373,6 +385,18 @@ restricted on HTTP/1.1 level, but no explicit HTTP/1.0 caching directive is
 given on specifying -E in the command-line causes skipfish to log all such
 cases carefully.
 
+In some occasions, you want to limit the requests per second to limit
+the load on the targets server (or possibly bypass DoS protection). The
+-l flag can be used to set this limit and the value given is the maximum
+amount of requests per second you want skipfish to perform.
+
+Scans typically should not take weeks. In many cases, you probably
+want to limit the scan duration so that it fits within a certain time
+window. This can be done with the -k flag, which allows the amount of
+hours, minutes and seconds to be specified in a H:M:S format. Use of
+this flag can affect the scan coverage if the scan timeout occurs before
+testing all pages.
+
 Lastly, in some assessments that involve self-contained sites without
 extensive user content, the auditor may care about any external e-mails or
 HTTP links seen, even if they have no immediate security impact. Use the -U
@@ -380,10 +404,10 @@ option to have these logged.
 
 Dictionary management is a special topic, and - as mentioned - is covered in
 more detail in dictionaries/README-FIRST. Please read that file before
-proceeding. Some of the relevant options include -W to specify a custom
-wordlist, -L to suppress auto-learning, -V to suppress dictionary updates, -G
-to limit the keyword guess jar size, -R to drop old dictionary entries, and
--Y to inhibit expensive $keyword.$extension fuzzing.
+proceeding. Some of the relevant options include -S and -W (covered earlier),
+-L to suppress auto-learning, -G to limit the keyword guess jar size, -R to
+drop old dictionary entries, and -Y to inhibit expensive $keyword.$extension
+fuzzing.
 
 Skipfish also features a form auto-completion mechanism in order to maximize
 scan coverage. The values should be non-malicious, as they are not meant to
@@ -423,21 +447,25 @@ Oh, and real-time scan statistics can be suppressed with -u.
 
 A standard, authenticated scan of a well-designed and self-contained site
 (warns about all external links, e-mails, mixed content, and caching header
-issues):
+issues), including gentle brute-force:
 
-$ ./skipfish -MEU -C "AuthCookie=value" -X /logout.aspx -o output_dir \
+$ touch new_dict.wl
+$ ./skipfish -MEU -S dictionaries/minimal.wl -W new_dict.wl \
+  -C "AuthCookie=value" -X /logout.aspx -o output_dir \
   http://www.example.com/
 
 Five-connection crawl, but no brute-force; pretending to be MSIE and and
 trusting example.com content:
 
-$ ./skipfish -m 5 -LV -W /dev/null -o output_dir -b ie -B example.com \
+$ ./skipfish -m 5 -L -W- -o output_dir -b ie -B example.com \
   http://www.example.com/
 
-Brute force only (no HTML link extraction), limited to a single directory and
-timing out after 5 seconds:
+Heavy brute force only (no HTML link extraction), limited to a single
+directory and timing out after 5 seconds:
 
-$ ./skipfish -P -I http://www.example.com/dir1/ -o output_dir -t 5 -I \
+$ touch new_dict.wl
+$ ./skipfish -S dictionaries/complete.wl -W new_dict.wl \
+   -P -I http://www.example.com/dir1/ -o output_dir -t 5 -I \
   http://www.example.com/dir1/
 
 For a short list of all command-line options, try ./skipfish -h.
@@ -516,8 +544,6 @@ know:
 
   * Scheduling and management web UI.
 
-  * QPS throttling and maximum scan time limit.
-
   * A database for banner / version checks or other configurable rules?
 
 -------------------------------------
@@ -560,4 +586,4 @@ Skipfish is made possible thanks to the contributions of, and valuable
 feedback from, Google's information security engineering team.
 
 If you have any bug reports, questions, suggestions, or concerns regarding
-the application, the author can be reached at lcamtuf@google.com.
+the application, the primary author can be reached at lcamtuf@google.com.
diff --git a/analysis.c b/analysis.c
index b60c5dd..203a35f 100644
--- a/analysis.c
+++ b/analysis.c
@@ -111,7 +111,7 @@ void pivot_header_checks(struct http_request* req,
 /* Helper for scrape_response(). Tries to add a previously extracted link,
    also checks for cross-site and mixed content issues and similar woes.
    Subres is: 1 - redirect; 2 - IMG; 3 - IFRAME, EMBED, OBJECT, APPLET;
-   4 - SCRIPT, LINK REL=STYLESHEET; 0 - everything else. */
+   4 - SCRIPT, LINK REL=STYLESHEET; 5 - form; 0 - everything else. */
 
 static void test_add_link(u8* str, struct http_request* ref,
                           struct http_response* res, u8 subres, u8 sure) {
@@ -187,8 +187,11 @@ static void test_add_link(u8* str, struct http_request* ref,
 
     if (ref->proto == PROTO_HTTPS && n->proto == PROTO_HTTP &&
         subres > 2 && warn_mixed)
-      problem((subres == 4) ? PROB_MIXED_SUB : PROB_MIXED_OBJ,
-              ref, res, str, ref->pivot, 0);
+      switch (subres) {
+        case 4: problem(PROB_MIXED_SUB, ref, res, str, ref->pivot, 0); break;
+        case 5: problem(PROB_MIXED_FORM, ref, res, str, ref->pivot, 0); break;
+        default: problem(PROB_MIXED_OBJ, ref, res, str, ref->pivot, 0);
+      }
 
   } else if (!ref->proto) {
 
@@ -829,7 +832,7 @@ void scrape_response(struct http_request* req, struct http_response* res) {
         if (!parse_url(clean_url, n, base ? base : req) && url_allowed(n) &&
             R(100) < crawl_prob && !no_forms) {
           collect_form_data(n, req, res, tag_end + 1, (parse_form == 2));
-          maybe_add_pivot(n, NULL, 2);
+          maybe_add_pivot(n, NULL, 5);
         }
 
         destroy_request(n);
@@ -1279,6 +1282,16 @@ static void check_js_xss(struct http_request* req, struct http_response* res,
         problem(PROB_URL_XSS, req, res,
           (u8*)"injected URL in JS/CSS code", req->pivot, 0);
 
+      u8* end_quote = text;
+      while(*end_quote && end_quote++ && *end_quote != in_quot)
+        if(*end_quote == '\\') end_quote++;
+
+      /* Injected string is 'skip'''"fish""" */
+      if(end_quote && !case_prefix(end_quote + 1,"skip'''"))
+        problem(PROB_URL_XSS, req, res, (u8*)"injected string in JS/CSS code (single quote not escaped)", req->pivot, 0);
+      if(end_quote && !case_prefix(end_quote + 1,"fish\"\"\""))
+        problem(PROB_URL_XSS, req, res, (u8*)"injected string in JS/CSS code (double quote not escaped)", req->pivot, 0);
+
     } else if (in_quot && *text == in_quot) in_quot = 0;
 
     else if (!in_quot && !case_prefix(text, "sfi") &&
@@ -1414,8 +1427,9 @@ next_elem:
 
 void content_checks(struct http_request* req, struct http_response* res) {
   u8* tmp;
-  u32 tag_id, scan_id;
+  u32 off, tag_id, scan_id;
   u8  high_risk = 0;
+  struct http_request* n;
 
   DEBUG_CALLBACK(req, res);
 
@@ -1461,6 +1475,24 @@ void content_checks(struct http_request* req, struct http_response* res) {
       h10c = 1;
     }
 
+    /* Check if injection strings ended up in one of our cookie name or
+       values and complain */
+
+    u32 i = 0;
+
+    while(injection_headers[i]) {
+      off = 0;
+
+      do {
+        tmp = GET_HDR_OFF((u8*)injection_headers[i], &res->hdr,off++);
+        if(tmp && strstr((char*)tmp, "skipfish://invalid/;"))
+          problem(PROB_HEADER_INJECT,req, res,
+                 (u8*)injection_headers[i], req->pivot, 0);
+
+      } while(tmp);
+      i++;
+    }
+
     /* Check HTTP/1.1 intent next. Detect conflicting keywords. */
 
     if (cc) {
@@ -1563,6 +1595,18 @@ void content_checks(struct http_request* req, struct http_response* res) {
       !inl_findstr(res->payload, (u8*)"function(", 1024))
     problem(PROB_JS_XSSI, req, res, NULL, req->pivot, 0);
 
+
+  /* If the response resembles javascript and a callback parameter does
+     not exist, we'll add this parameter in an attempt to catch JSONP
+     issues */
+
+  if(is_javascript(res) && !GET_PAR((u8*)"callback", &req->par)) {
+    n = req_copy(RPREQ(req), req->pivot, 1);
+    SET_PAR((u8*)"callback",(u8*)"hello",&n->par);
+    maybe_add_pivot(n, NULL, 2);
+    destroy_request(n);
+  }
+
   tmp = res->payload;
 
   do {
@@ -1884,6 +1928,7 @@ binary_checks:
 
 static void detect_mime(struct http_request* req, struct http_response* res) {
   u8 sniffbuf[SNIFF_LEN];
+  s32 fuzzy_match = -1;
 
   if (res->sniff_mime_id) return;
 
@@ -1900,7 +1945,7 @@ static void detect_mime(struct http_request* req, struct http_response* res) {
       while (mime_map[i][j]) {
         if (mime_map[i][j][0] == '?') {
           if (!strncasecmp((char*)mime_map[i][j] + 1, (char*)res->header_mime,
-               strlen((char*)mime_map[i][j] + 1))) break;
+               strlen((char*)mime_map[i][j] + 1))) fuzzy_match = i;
         } else {
           if (!strcasecmp((char*)mime_map[i][j], (char*)res->header_mime))
             break;
@@ -1912,8 +1957,11 @@ static void detect_mime(struct http_request* req, struct http_response* res) {
 
     }
 
-    if (i != MIME_COUNT) res->decl_mime_id = i;
-
+    if (i != MIME_COUNT) {
+      res->decl_mime_id = i;
+    } else if (fuzzy_match != -1) {
+      res->decl_mime_id = fuzzy_match;
+    }
   }
 
   /* Next, work out the actual MIME that should be set. Mostly
diff --git a/analysis.h b/analysis.h
index f1716e0..6b27cee 100644
--- a/analysis.h
+++ b/analysis.h
@@ -25,7 +25,6 @@
 #include "types.h"
 #include "http_client.h"
 #include "database.h"
-#include "crawler.h"
 
 extern u8  no_parse,            /* Disable HTML link detection */
            warn_mixed,          /* Warn on mixed content       */
@@ -202,6 +201,17 @@ static char* mime_map[MIME_COUNT][8] = {
 
 };
 
+/* A set of headers that we check to see if our injection string ended
+   up in their value. This list should only contain headers where control
+   over the value could potentially be exploited. */
+
+static const char* injection_headers[] = {
+  "Set-Cookie",
+  "Set-Cookie2",
+  "Content-Type",
+  0,
+};
+
 #endif /* _VIA_ANALYSIS_C */
 
 #endif /* !_HAVE_ANALYSIS_H */
diff --git a/assets/index.html b/assets/index.html
index 93e5ed1..c836ff0 100644
--- a/assets/index.html
+++ b/assets/index.html
@@ -294,10 +294,12 @@ var issue_desc= {
   "30402": "Attacker-supplied URLs in embedded content (lower risk)",
   "30501": "External content embedded on a page (lower risk)",
   "30502": "Mixed content embedded on a page (lower risk)",
+  "30503": "HTTPS form submitting to a HTTP URL",
   "30601": "HTML form with no apparent XSRF protection",
   "30602": "JSON response with no apparent XSSI protection",
   "30701": "Incorrect caching directives (lower risk)",
   "30801": "User-controlled response prefix (BOM / plugin attacks)",
+  "30901": "HTTP header injection vector",
 
   "40101": "XSS vector in document body",
   "40102": "XSS vector via arbitrary URLs",
diff --git a/config.h b/config.h
index 616ae08..4d938ca 100644
--- a/config.h
+++ b/config.h
@@ -36,13 +36,13 @@
 /* Default paths to runtime files: */
 
 #define ASSETS_DIR              "assets"
-#define DEF_WORDLIST            "skipfish.wl"
 
 /* Various default settings for HTTP client (cmdline override): */
 
 #define MAX_CONNECTIONS         40      /* Simultaneous connection cap     */
 #define MAX_CONN_HOST           10      /* Per-host connction cap          */
 #define MAX_REQUESTS            1e8     /* Total request count cap         */
+#define MAX_REQUESTS_SEC        0.0     /* Max requests per second         */
 #define MAX_FAIL                100     /* Max consecutive failed requests */
 #define RW_TMOUT                10      /* Individual network R/W timeout  */
 #define RESP_TMOUT              20      /* Total request time limit        */
@@ -148,6 +148,17 @@
 #define XSRF_B64_NUM2   3               /* ...digit count override         */
 #define XSRF_B64_SLASH  2               /* ...maximum slash count          */
 
+#ifdef _VIA_CRAWLER_C
+
+/* The URL and string we use in the RFI test */
+
+#ifdef RFI_SUPPORT
+#define RFI_HOST   "http://www.google.com/humans.txt#foo="
+#define RFI_STRING "we can shake a stick"
+#endif
+
+#endif /* _VIA_CRAWLER_C */
+
 #ifdef _VIA_DATABASE_C
 
 /* Domains we always trust (identical to -B options). These entries do not
diff --git a/crawler.c b/crawler.c
index 6f67d6f..b7584b2 100644
--- a/crawler.c
+++ b/crawler.c
@@ -598,7 +598,8 @@ static void secondary_ext_start(struct pivot_desc* pv, struct http_request* req,
                                 struct http_response* res, u8 is_param) {
 
   u8 *base_name, *fpos, *lpos, *ex;
-  s32 tpar = -1, i = 0, spar = -1;
+  s32 tpar = -1, spar = -1;
+  u32 i = 0;
 
   DEBUG_HELPER(req->pivot);
   DEBUG_HELPER(pv);
@@ -720,12 +721,25 @@ static void inject_start(struct pivot_desc* pv) {
 
   if (pv->type == PIVOT_DIR || pv->type == PIVOT_SERV) {
     struct http_request* n;
+
+    /* First a PUT request */
     n = req_copy(pv->req, pv, 1);
     if (n->method) ck_free(n->method);
     n->method   = ck_strdup((u8*)"PUT");
+    n->user_val = 0;
     n->callback = put_upload_check;
     replace_slash(n, (u8*)("PUT-" BOGUS_FILE));
     async_request(n);
+
+    /* Second a FOO for false positives */
+    n = req_copy(pv->req, pv, 1);
+    if (n->method) ck_free(n->method);
+    n->method   = ck_strdup((u8*)"FOO");
+    n->user_val = 1;
+    n->callback = put_upload_check;
+    replace_slash(n, (u8*)("PUT-" BOGUS_FILE));
+    async_request(n);
+
   } else {
     inject_start2(pv);
   }
@@ -740,13 +754,22 @@ static u8 put_upload_check(struct http_request* req,
 
   if (FETCH_FAIL(res)) {
     handle_error(req, res, (u8*)"during PUT checks", 0);
-  } else {
-    if (res->code >= 200 && res->code < 300 &&
-        !same_page(&RPRES(req)->sig, &res->sig)) {
-      problem(PROB_PUT_DIR, req, res, 0, req->pivot, 0);
-    }
+    goto schedule_next;
   }
 
+  req->pivot->misc_req[req->user_val] = req;
+  req->pivot->misc_res[req->user_val] = res;
+  if ((++req->pivot->misc_cnt) != 2) return 1;
+
+  /* If PUT and FOO of the page does not give the same result. And if
+  additionally we get a 2xx code, than we'll mark the issue as detected */
+  if(same_page(&MRES(0)->sig, &MRES(1)->sig) &&
+     MRES(0)->code >= 200 && MRES(1)->code < 300)
+    problem(PROB_PUT_DIR, MREQ(0), MRES(0), 0, req->pivot, 0);
+
+schedule_next:
+
+  destroy_misc_data(req->pivot, req);
   inject_start2(req->pivot);
   return 0;
 
@@ -773,8 +796,9 @@ static void inject_start2(struct pivot_desc* pv) {
 static u8 inject_behavior_check(struct http_request* req,
                                 struct http_response* res) {
   struct http_request* n;
-  u32 orig_state = req->pivot->state;
   u8* tmp = NULL;
+  u32 orig_state = req->pivot->state;
+  u32 i;
 
   /* pv->state may change after async_request() calls in
      insta-fail mode, so we should cache accordingly. */
@@ -867,29 +891,37 @@ static u8 inject_behavior_check(struct http_request* req,
 
   if (orig_state != PSTATE_CHILD_INJECT) {
 
+    /* We combine the traversal and file disclosure attacks here since
+      the checks are almost identical */
+
+    i = 0;
+    while(disclosure_tests[i]) {
+      n = req_copy(req->pivot->req, req->pivot, 1);
+
+      ck_free(TPAR(n));
+      TPAR(n) = ck_strdup((u8*)disclosure_tests[i]);
+
+      n->callback = inject_dir_listing_check;
+      n->user_val = 4 + i;
+      async_request(n);
+      i++;
+    }
+
+#ifdef RFI_SUPPORT
+    /* Optionally try RFI */
     n = req_copy(req->pivot->req, req->pivot, 1);
 
     ck_free(TPAR(n));
-    TPAR(n) = ck_strdup((u8*)"../../../../../../../../etc/hosts");
+    TPAR(n) = ck_strdup((u8*)RFI_HOST);
 
     n->callback = inject_dir_listing_check;
-    n->user_val = 4;
-    async_request(n);
-
-    n = req_copy(req->pivot->req, req->pivot, 1);
-
-    ck_free(TPAR(n));
-    TPAR(n) = ck_strdup((u8*)"..\\..\\..\\..\\..\\..\\..\\..\\boot.ini");
-
-    n->callback = inject_dir_listing_check;
-    n->user_val = 5;
+    n->user_val = 4 + i;
     async_request(n);
+#endif
 
   }
 
-
   return 0;
-
 }
 
 
@@ -912,7 +944,11 @@ static u8 inject_dir_listing_check(struct http_request* req,
   req->pivot->misc_res[req->user_val] = res;
 
   if (req->pivot->i_skip_add) {
-    if ((++req->pivot->misc_cnt) != 6) return 1;
+#ifdef RFI_SUPPORT
+    if ((++req->pivot->misc_cnt) != 12) return 1;
+#else
+    if ((++req->pivot->misc_cnt) != 11) return 1;
+#endif
   } else {
     if ((++req->pivot->misc_cnt) != 4) return 1;
   }
@@ -935,13 +971,22 @@ static u8 inject_dir_listing_check(struct http_request* req,
        misc[1] = ./known_val
        misc[2] = ...\known_val
        misc[3] = .\known_val
-       misc[4] = ../../../../../../../../etc/hosts
-       misc[5] = ..\..\..\..\..\..\..\..\boot.ini
 
      Here, the test is simpler: if misc[1] != misc[0], or misc[3] !=
      misc[2], we probably have a bug. The same if misc[4] or misc[5]
      contain magic strings, but misc[0] doesn't.
 
+     Finally, we perform some directory traveral and file inclusion tests.
+
+       misc[4] = ../../../../../../../../etc/hosts
+       misc[5] = ../../../../../../../../etc/passwd
+       misc[6] = ..\..\..\..\..\..\..\..\boot.ini
+       misc[7] = ../../../../../../../../WEB-INF/web.xml
+       misc[8] = file:///etc/hosts
+       misc[9] = file:///etc/passwd
+       misc[10] = file:///boot.ini
+       misc[11] = RFI (optional)
+
  */
 
   if (orig_state == PSTATE_CHILD_INJECT) {
@@ -984,18 +1029,56 @@ static u8 inject_dir_listing_check(struct http_request* req,
       RESP_CHECKS(MREQ(2), MRES(2));
     }
 
-    if (inl_findstr(MRES(4)->payload, (u8*)"127.0.0.1", 512) &&
-        !inl_findstr(MRES(0)->payload, (u8*)"127.0.0.1", 512)) {
-      problem(PROB_DIR_TRAVERSAL, MREQ(4), MRES(4),
-        (u8*)"response resembles /etc/hosts", req->pivot, 0);
+    /* Check on the /etc/hosts file disclosure */
+    if(!inl_findstr(MRES(0)->payload, (u8*)"127.0.0.1", 1024)) {
+      if (inl_findstr(MRES(4)->payload, (u8*)"127.0.0.1", 1024)) {
+
+        problem(PROB_FI_LOCAL, MREQ(4), MRES(4),
+                (u8*)"response resembles /etc/hosts (via traversal)", req->pivot, 0);
+      } else if(inl_findstr(MRES(8)->payload, (u8*)"127.0.0.1", 1024)) {
+            problem(PROB_FI_LOCAL, MREQ(8), MRES(8),
+                    (u8*)"response resembles /etc/hosts (via file://)", req->pivot, 0);
+      }
     }
 
-    if (inl_findstr(MRES(5)->payload, (u8*)"[boot loader]", 512) &&
-        !inl_findstr(MRES(0)->payload, (u8*)"[boot loader]", 512)) {
-      problem(PROB_DIR_TRAVERSAL, MREQ(5), MRES(5),
-        (u8*)"response resembles c:\\boot.ini", req->pivot, 0);
+    /* Check on the /etc/passwd file disclosure */
+    if(!inl_findstr(MRES(0)->payload, (u8*)"root:x:0:0:root", 1024)) {
+      if(inl_findstr(MRES(5)->payload, (u8*)"root:x:0:0:root", 1024)) {
+            problem(PROB_FI_LOCAL, MREQ(5), MRES(5),
+                    (u8*)"response resembles /etc/passwd (via traversal)", req->pivot, 0);
+      } else if(inl_findstr(MRES(9)->payload, (u8*)"root:x:0:0:root", 1024)) {
+            problem(PROB_FI_LOCAL, MREQ(9), MRES(9),
+                    (u8*)"response resembles /etc/passwd (via file://)", req->pivot, 0);
+      }
     }
 
+    /* Windows boot.ini disclosure */
+    if(!inl_findstr(MRES(0)->payload, (u8*)"[boot loader]", 1024)) {
+        if (inl_findstr(MRES(6)->payload, (u8*)"[boot loader]", 1024)) {
+            problem(PROB_FI_LOCAL, MREQ(6), MRES(6),
+                    (u8*)"response resembles c:\\boot.ini (via traversal)", req->pivot, 0);
+        } else if (inl_findstr(MRES(10)->payload, (u8*)"[boot loader]", 1024)) {
+            problem(PROB_FI_LOCAL, MREQ(10), MRES(9),
+                    (u8*)"response resembles c:\\boot.ini (via file://)", req->pivot, 0);
+        }
+    }
+
+    /* Check the web.xml disclosure */
+    if(!inl_findstr(MRES(0)->payload, (u8*)"<servlet-mapping>", 1024)) {
+      if (inl_findstr(MRES(7)->payload, (u8*)"<servlet-mapping>", 1024))
+        problem(PROB_FI_LOCAL, MREQ(7), MRES(7),
+                (u8*)"response resembles ./WEB-INF/web.xml (via traversal)", req->pivot, 0);
+    }
+
+
+#ifdef RFI_SUPPORT
+    if (!inl_findstr(MRES(0)->payload, (u8*)RFI_STRING, 1024) && 
+        inl_findstr(MRES(11)->payload, (u8*)RFI_STRING, 1024)) {
+      problem(PROB_FI_REMOTE, MREQ(11), MRES(11),
+        (u8*)"remote file inclusion", req->pivot, 0);
+    }
+#endif
+
   }
 
 schedule_next:
@@ -1232,7 +1315,7 @@ schedule_next:
   if (req->user_val) return 0;
 
   n = req_copy(RPREQ(req), req->pivot, 1);
-  SET_VECTOR(orig_state, n, (u8*)"SKIPFISH~STRING");
+  SET_VECTOR(orig_state, n, (u8*)"+/skipfish-bom");
   n->callback = inject_prologue_check;
   async_request(n);
 
@@ -1255,13 +1338,13 @@ static u8 inject_prologue_check(struct http_request* req,
     goto schedule_next;
   }
 
-  if (res->pay_len && !prefix(res->payload, (u8*)"SKIPFISH~STRING") &&
+  if (res->pay_len && !prefix(res->payload, (u8*)"+/skipfish-bom") &&
       !GET_HDR((u8*)"Content-Disposition", &res->hdr))
     problem(PROB_PROLOGUE, req, res, NULL, req->pivot, 0);
 
 schedule_next:
 
-  /* XSS checks - 3 requests */
+  /* XSS checks - 4 requests */
 
   n = req_copy(RPREQ(req), req->pivot, 1);
   SET_VECTOR(orig_state, n, "http://skipfish.invalid/;?");
@@ -1281,8 +1364,13 @@ schedule_next:
   n->user_val = 2;
   async_request(n);
 
-  return 0;
+  n = req_copy(RPREQ(req), req->pivot, 1);
+  SET_VECTOR(orig_state, n, "'skip'''\"fish\"\"\"");
+  n->callback = inject_redir_check;
+  n->user_val = 3;
+  async_request(n);
 
+  return 0;
 }
 
 
@@ -2755,9 +2843,14 @@ bad_404:
     } else {
 
       if (req->pivot->type != PIVOT_SERV) {
+        /* todo(niels) improve behavior by adding a new pivot */
+        n = req_copy(RPREQ(req), req->pivot, 1);
+        replace_slash(n, NULL);
+        maybe_add_pivot(n, NULL, 2);
         req->pivot->type = PIVOT_PATHINFO;
-        replace_slash(req->pivot->req, NULL);
-      } else 
+        destroy_request(n);
+
+      } else
         problem(PROB_404_FAIL, RPREQ(req), RPRES(req),
                 (u8*)"no distinctive 404 behavior detected", req->pivot, 0);
     }
@@ -3395,4 +3488,3 @@ schedule_next:
 
   return keep;
 }
-
diff --git a/crawler.h b/crawler.h
index fe62f7f..fb55a8a 100644
--- a/crawler.h
+++ b/crawler.h
@@ -26,6 +26,25 @@
 #include "http_client.h"
 #include "database.h"
 
+#ifdef _VIA_CRAWLER_C
+
+/* Strings for traversal and file disclosure tests. The order should
+   not be changed  */
+
+static const char* disclosure_tests[] = {
+  "../../../../../../../../etc/hosts",
+  "../../../../../../../../etc/passwd",
+  "..\\..\\..\\..\\..\\..\\..\\..\\boot.ini",
+  "../../../../../../../../WEB-INF/web.xml",
+  "file:///etc/hosts",
+  "file:///etc/passwd",
+  "file:///boot.ini",
+  0
+};
+
+#endif
+
+
 extern u32 crawl_prob;          /* Crawl probability (1-100%)  */
 extern u8  no_parse,            /* Disable HTML link detection */
            warn_mixed,          /* Warn on mixed content?      */
@@ -64,11 +83,12 @@ void add_form_hint(u8* name, u8* value);
 
 /* Macros to access various useful pivot points: */
 
-#define MREQ(_x) (req->pivot->misc_req[_x])
-#define MRES(_x) (req->pivot->misc_res[_x])
 #define RPAR(_req) ((_req)->pivot->parent)
 #define RPREQ(_req) ((_req)->pivot->req)
 #define RPRES(_req) ((_req)->pivot->res)
+#define MREQ(_x) (req->pivot->misc_req[_x])
+#define MRES(_x) (req->pivot->misc_res[_x])
+
 
 /* Debugging instrumentation for callbacks and callback helpers: */
 
diff --git a/database.c b/database.c
index de41b31..a3a0eca 100644
--- a/database.c
+++ b/database.c
@@ -82,14 +82,14 @@ struct ext_entry {
   u32 index;
 };
 
-static struct ext_entry *extension,     /* Extension list                  */
-                        *sp_extension;
+static struct ext_entry *wg_extension,     /* Extension list */
+                        *ws_extension;
 
 static u8 **guess;                      /* Keyword candidate list          */
 
 u32 guess_cnt,                          /* Number of keyword candidates    */
-    extension_cnt,                      /* Number of extensions            */
-    sp_extension_cnt,                   /* Number of specific extensions   */
+    ws_extension_cnt,                   /* Number of specific extensions   */
+    wg_extension_cnt,                   /* Number of extensions            */
     keyword_total_cnt,                  /* Current keyword count           */
     keyword_orig_cnt;                   /* At-boot keyword count           */
 
@@ -165,8 +165,9 @@ void maybe_add_pivot(struct http_request* req, struct http_response* res,
 
     if (PATH_SUBTYPE(req->par.t[i])) {
 
-      if (req->par.t[i] == PARAM_PATH && !req->par.n[i] && !req->par.v[i][0])
-        ends_with_slash = 1; 
+      if (req->par.t[i] == PARAM_PATH && !req->par.n[i] &&
+          req->par.v[i] && !req->par.v[i][0])
+        ends_with_slash = 1;
       else
         ends_with_slash = 0;
 
@@ -898,10 +899,10 @@ static void wordlist_confirm_single(u8* text, u8 is_ext, u8 class, u8 read_only,
       if (!keyword[kh][i].is_ext && is_ext) {
         keyword[kh][i].is_ext = 1;
 
-        extension = ck_realloc(extension, (extension_cnt + 1) * 
+        wg_extension = ck_realloc(wg_extension, (wg_extension_cnt + 1) *
                     sizeof(struct ext_entry));
-        extension[extension_cnt].bucket = kh;
-        extension[extension_cnt++].index = i;
+        wg_extension[wg_extension_cnt].bucket = kh;
+        wg_extension[wg_extension_cnt++].index = i;
       }
 
       return;
@@ -929,20 +930,18 @@ static void wordlist_confirm_single(u8* text, u8 is_ext, u8 class, u8 read_only,
 
   if (is_ext) {
 
-    extension = ck_realloc(extension, (extension_cnt + 1) * 
+    wg_extension = ck_realloc(wg_extension, (wg_extension_cnt + 1) * 
                 sizeof(struct ext_entry));
-    extension[extension_cnt].bucket = kh;
-    extension[extension_cnt++].index = i;
-
-    if (class == KW_SPECIFIC) {
-
-      sp_extension = ck_realloc(sp_extension, (sp_extension_cnt + 1) * 
-                  sizeof(struct ext_entry));
-      sp_extension[sp_extension_cnt].bucket = kh;
-      sp_extension[sp_extension_cnt++].index = i;
+    wg_extension[wg_extension_cnt].bucket = kh;
+    wg_extension[wg_extension_cnt++].index = i;
 
+    /* We only add generic extensions to the ws list. */
+    if (class == KW_GENERIC) {
+      ws_extension = ck_realloc(ws_extension, (ws_extension_cnt + 1) * 
+                sizeof(struct ext_entry));
+      ws_extension[ws_extension_cnt].bucket = kh;
+      ws_extension[ws_extension_cnt++].index = i;
     }
-
   }
 
 }
@@ -1065,12 +1064,12 @@ u8* wordlist_get_guess(u32 offset, u8* specific) {
 u8* wordlist_get_extension(u32 offset, u8 specific) {
 
   if (!specific) {
-    if (offset >= extension_cnt) return NULL;
-    return keyword[extension[offset].bucket][extension[offset].index].word;
+    if (offset >= wg_extension_cnt) return NULL;
+    return keyword[wg_extension[offset].bucket][wg_extension[offset].index].word;
   }
 
-  if (offset >= sp_extension_cnt) return NULL;
-  return keyword[sp_extension[offset].bucket][sp_extension[offset].index].word;
+  if (offset >= ws_extension_cnt) return NULL;
+  return keyword[ws_extension[offset].bucket][ws_extension[offset].index].word;
 }
 
 
@@ -1089,12 +1088,16 @@ void load_keywords(u8* fname, u8 read_only, u32 purge_age) {
   in = fopen((char*)fname, "r");
 
   if (!in) {
-    PFATAL("Unable to open wordlist '%s'", fname);
-    return;
+    if (read_only)
+      PFATAL("Unable to open read-only wordlist '%s'.", fname);
+    else
+      PFATAL("Unable to open read-write wordlist '%s' (see dictionaries/README-FIRST).", fname);
   }
 
   sprintf(fmt, "%%2s %%u %%u %%u %%%u[^\x01-\x1f]", MAX_WORD);
 
+wordlist_retry:
+
   while ((fields = fscanf(in, fmt, type, &hits, &total_age, &last_age, kword))
           == 5) {
 
@@ -1113,12 +1116,24 @@ void load_keywords(u8* fname, u8 read_only, u32 purge_age) {
     fgetc(in); /* sink \n */
   }
 
+  if (fields == 1 && !strcmp((char*)type, "#r")) {
+    printf("Found %s (readonly:%d)\n", type, read_only);
+    if (!read_only)
+      FATAL("Attempt to load read-only wordlist '%s' via -W (use -S instead).\n", fname);
+
+    fgetc(in); /* sink \n */
+    goto wordlist_retry;
+  }
+
   if (fields != -1 && fields != 5)
     FATAL("Wordlist '%s': syntax error in line %u.\n", fname, lines);
 
-  if (!lines)
+  if (!lines && (read_only || !keyword_total_cnt))
     WARN("Wordlist '%s' contained no valid entries.", fname);
 
+  DEBUG("* Read %d lines from dictionary '%s' (read-only = %d).\n", lines,
+        fname, read_only);
+
   keyword_orig_cnt = keyword_total_cnt;
 
   fclose(in);
@@ -1151,6 +1166,8 @@ void save_keywords(u8* fname) {
 #define O_NOFOLLOW 0
 #endif /* !O_NOFOLLOW */
 
+  /* Don't save keywords for /dev/null and other weird files. */
+
   if (stat((char*)fname, &st) || !S_ISREG(st.st_mode)) return;
 
   /* First, sort the list. */
@@ -1281,7 +1298,7 @@ void database_stats() {
       pivot_serv, pivot_dir, pivot_file, pivot_pinfo, pivot_unknown,
       pivot_param, pivot_value, issue_cnt[1], issue_cnt[2], issue_cnt[3],
        issue_cnt[4], issue_cnt[5], keyword_total_cnt, keyword_total_cnt -
-      keyword_orig_cnt, extension_cnt, guess_cnt);
+      keyword_orig_cnt, wg_extension_cnt, guess_cnt);
 
 }
 
@@ -1486,8 +1503,8 @@ void destroy_database() {
   }
 
   /* Extensions just referenced keyword[][] entries. */
-  ck_free(extension);
-  ck_free(sp_extension);
+  ck_free(wg_extension);
+  ck_free(ws_extension);
 
   for (i=0;i<guess_cnt;i++) ck_free(guess[i]);
   ck_free(guess);
diff --git a/database.h b/database.h
index 500715e..3a305b4 100644
--- a/database.h
+++ b/database.h
@@ -133,7 +133,7 @@ struct pivot_desc {
 
   /* Injection attack logic scratchpad: */
 
-#define MISC_ENTRIES 10
+#define MISC_ENTRIES 15
 
   struct http_request*  misc_req[MISC_ENTRIES]; /* Saved requests            */
   struct http_response* misc_res[MISC_ENTRIES]; /* Saved responses           */
@@ -258,6 +258,7 @@ u8 is_c_sens(struct pivot_desc* pv);
 
 #define PROB_EXT_OBJ            30501           /* External obj standalone   */
 #define PROB_MIXED_OBJ          30502           /* Mixed content standalone  */
+#define PROB_MIXED_FORM         30503           /* HTTPS -> HTTP form        */
 
 #define PROB_VULN_FORM          30601           /* Form w/o anti-XSRF token  */
 #define PROB_JS_XSSI            30602           /* Script with no XSSI prot  */
@@ -266,6 +267,8 @@ u8 is_c_sens(struct pivot_desc* pv);
 
 #define PROB_PROLOGUE           30801           /* User-supplied prologue    */
 
+#define PROB_HEADER_INJECT      30901           /* Injected string in header */
+
 /* - Moderate severity issues (data compromise): */
 
 #define PROB_BODY_XSS           40101           /* Document body XSS         */
@@ -297,6 +300,8 @@ u8 is_c_sens(struct pivot_desc* pv);
 #define PROB_SQL_INJECT         50103           /* SQL injection             */
 #define PROB_FMT_STRING         50104           /* Format string attack      */
 #define PROB_INT_OVER           50105           /* Integer overflow attack   */
+#define PROB_FI_LOCAL           50106           /* Local file inclusion      */
+#define PROB_FI_REMOTE          50107           /* Local remote inclusion    */
 
 #define PROB_SQL_PARAM          50201           /* SQL-like parameter        */
 
@@ -353,7 +358,7 @@ extern u32 max_depth,
            max_guesses;
 
 extern u32 guess_cnt,
-           extension_cnt,
+           wg_extension_cnt,
            keyword_total_cnt,
            keyword_orig_cnt;
 
diff --git a/dictionaries/README-FIRST b/dictionaries/README-FIRST
index bec71ce..555701a 100644
--- a/dictionaries/README-FIRST
+++ b/dictionaries/README-FIRST
@@ -1,33 +1,50 @@
 This directory contains four alternative, hand-picked Skipfish dictionaries.
 
-PLEASE READ THIS FILE CAREFULLY BEFORE PICKING ONE. This is *critical* to
-getting good results in your work.
+PLEASE READ THESE INSTRUCTIONS CAREFULLY BEFORE PICKING ONE. This is *critical*
+to getting decent results in your scans.
 
 ------------------------
 Key command-line options
 ------------------------
 
-The dictionary to be used by the tool can be specified with the -W option,
-and must conform to the format outlined at the end of this document. If you
-omit -W in the command line, 'skipfish.wl' is assumed. This file does not
-exist by default. That part is by design: THE SCANNER WILL MODIFY THE
-SUPPLIED FILE UNLESS SPECIFICALLY INSTRUCTED NOT TO.
+Skipfish automatically builds and maintain dictionaries based on the URLs
+and HTML content encountered while crawling the site. These dictionaries
+are extremely useful for subsequent scans of the same target, or for
+future assessments of other platforms belonging to the same customer. 
 
-That's because the scanner automatically learns new keywords and extensions
-based on any links discovered during the scan, and on random sampling of 
-site contents. The information is consequently stored in the dictionary
-for future reuse, along with other bookkeeping information useful for
-determining which keywords perform well, and which ones don't.
+Exactly one read-write dictionary needs to be specified for every scan. To
+create a blank one and feed it to skipfish, you can use this syntax:
 
-All this means that it is very important to maintain a separate dictionary
-for every separate set of unrelated target sites. Otherwise, undesirable
-interference will occur.
+$ touch new_dict.wl
+$ ./skipfish -W new_dict.wl [...other options...]
+
+In addition, it is almost always beneficial to seed the scanner with any
+number of supplemental, read-only dictionaries with common keywords useful
+for brute-force attacks against any website. Supplemental dictionaries can
+be loaded using the following syntax:
+
+$ ./skipfish -S supplemental_dict1.wl -S supplemental_dict2.wl \
+   -W new_dict.wl [...other options...]
+
+Note that the -W option should be used with care. The target file will be
+modified at the end of the scan. The -S dictionaries, on the other hand, are
+purely read-only. 
+
+If you don't want to create a dictionary and store discovered keywords, you
+can use -W- (an alias for -W /dev/null).
+
+You can and should share read-only dictionaries across unrelated scans, but
+a separate read-write dictionary should be used for scans of unrelated targets.
+Otherwise, undesirable interference may occur.
 
 With this out of the way, let's quickly review the options that may be used
 to fine-tune various aspects of dictionary handling:
 
   -L      - do not automatically learn new keywords based on site content.
 
+            The scanner will still use keywords found in the specified
+            dictionaries, if any; but will not go beyond that set.
+
             This option should not be normally used in most scanning
             modes; if supplied, the scanner will not be able to discover
             and leverage technology-specific terms and file extensions
@@ -42,19 +59,12 @@ to fine-tune various aspects of dictionary handling:
             gradually replaced with new picks, and then discarded at the
             end of the scan. The default jar size is 256.
 
-  -V      - prevent the scanner from updating the dictionary file.
-
-            Normally, the primary read-write dictionary specified with the
-            -W option is updated at the end of the scan to add any newly
-            discovered keywords, and to update keyword usage stats. Using
-            this option eliminates this step.
-
-  -R num  - purge all dictionary entries that had no non-404 hits for
+  -R num  - purge all entries in the read-write that had no non-404 hits for
             the last <num> scans.
 
             This option prevents dictionary creep in repeated assessments,
             but needs to be used with care: it will permanently nuke a
-            part of the dictionary!
+            part of the dictionary.
 
   -Y      - inhibit full ${filename}.${extension} brute-force.
 
@@ -77,7 +87,7 @@ associated request cost):
    scanner will not discover non-linked resources such as /admin,
    /index.php.old, etc:
 
-   ./skipfish -W /dev/null -LV [...other options...]
+   $ ./skipfish -W- -LV [...other options...]
 
    This mode is very fast, but *NOT* recommended for general use because of
    limited coverage. Use only where absolutely necessary.
@@ -86,8 +96,9 @@ associated request cost):
    will not discover resources such as /admin, but will discover cases such as
    /index.php.old (once index.php itself is spotted during an orderly crawl):
 
-   cp dictionaries/extensions-only.wl dictionary.wl
-   ./skipfish -W dictionary.wl -Y [...other options...]
+   $ touch new_dict.wl
+   $ ./skipfish -S dictionaries/extensions-only.wl -W new_dict.wl -Y \
+       [...other options...]
 
    This method is only slightly more request-intensive than #1, and therefore,
    is a marginally better alternative in cases where time is of essence. It's
@@ -98,8 +109,9 @@ associated request cost):
    try fuzzing the file name, or the extension, at any given time - but will
    not try every possible ${filename}.${extension} pair from the dictionary.
 
-   cp dictionaries/complete.wl dictionary.wl
-   ./skipfish -W dictionary.wl -Y [...other options...]
+   $ touch new_dict.wl
+   $ ./skipfish -S dictionaries/complete.wl -W new_dict.wl -Y \
+     [...other options...]
 
    This method has a cost of about 2,000 requests per fuzzed location, and is
    recommended for rapid assessments, especially when working with slow
@@ -109,41 +121,27 @@ associated request cost):
    pair will be attempted. This mode is significantly slower, but offers
    superior coverage, and should be your starting point.
 
-   cp dictionaries/XXX.wl dictionary.wl
-   ./skipfish -W dictionary.wl [...other options...]
+   $ touch new_dict.wl
+   $ ./skipfish -S dictionaries/XXX.wl -W new_dict.wl [...other options...]
 
    Replace XXX with:
 
-     minimal   - recommended starter dictionary, mostly focusing on backup
-                 and source files, about 60,000 requests per fuzzed location.
+     minimal        - recommended starter dictionary, mostly focusing on
+                      backup and source files, about 60,000 requests
+                      per fuzzed location.
 
-     medium    - more thorough dictionary, focusing on common frameworks,
-                 about 140,000 requests.
+     medium         - more thorough dictionary, focusing on common
+                      frameworks, about 140,000 requests.
 
-     complete  - all-inclusive dictionary, over 210,000 requests.
+     complete       - all-inclusive dictionary, over 210,000 requests.
+
+     complete-fast  - An optimized version of the 'complete' dictionary
+                      with 20-30% less requests.
 
    Normal fuzzing mode is recommended when doing thorough assessments of
    reasonably responsive servers; but it may be prohibitively expensive
    when dealing with very large or very slow sites.
 
-----------------------------------
-Using separate master dictionaries
-----------------------------------
-
-A recently introduced feature allows you to load any number of read-only
-supplementary dictionaries in addition to the "main" read-write one (-W
-dictionary.wl).
-
-This is a convenient way to isolate (and be able to continually update) your
-customized top-level wordlist, whilst still acquiring site-specific data in
-a separate file. The following syntax may be used to accomplish this:
-
-./skipfish -W initially_empty_site_specific_dict.wl -W +supplementary_dict1.wl \
-  -W +supplementary_dict2.wl [...other options...]
-
-Only the main dictionary will be modified as a result of the scan, and only
-newly discovered site-specific keywords will be appended there.
-
 ----------------------------
 More about dictionary design
 ----------------------------
@@ -204,7 +202,7 @@ files such as ${this_word}.php or ${this_word}.class. If not, tag the keyword
 as 'ws'.
 
 Similarly, to decide between 'eg' and 'es', think about the possibility of
-encoutering cgi-bin.${this_ext} or formmail.${this_ext}. If it seems unlikely,
+encountering cgi-bin.${this_ext} or zencart.${this_ext}. If it seems unlikely,
 choose 'es'.
 
 For your convenience, all legacy keywords and extensions, as well as any entries
@@ -222,6 +220,9 @@ Other notes about dictionaries:
     and all keywords should be NOT url-encoded (e.g., 'Program Files', not
     'Program%20Files'). No keyword should exceed 64 characters.
 
+  - Any valuable dictionary can be tagged with an optional '#ro' line at the
+    beginning. This prevents it from being loaded in read-write mode.
+
   - Tread carefully; poor wordlists are one of the reasons why some web security
     scanners perform worse than expected. You will almost always be better off
     narrowing down or selectively extending the supplied set (and possibly
diff --git a/dictionaries/complete-fast.wl b/dictionaries/complete-fast.wl
new file mode 100644
index 0000000..2506ac4
--- /dev/null
+++ b/dictionaries/complete-fast.wl
@@ -0,0 +1,2167 @@
+#ro
+eg 1 1 1 7z
+es 1 1 1 as
+es 1 1 1 asmx
+es 1 1 1 asp
+es 1 1 1 aspx
+eg 1 1 1 bak
+es 1 1 1 bat
+eg 1 1 1 bin
+eg 1 1 1 bz2
+es 1 1 1 c
+es 1 1 1 cc
+eg 1 1 1 cfg
+es 1 1 1 cfm
+es 1 1 1 cgi
+es 1 1 1 class
+eg 1 1 1 cnf
+eg 1 1 1 conf
+eg 1 1 1 config
+eg 1 1 1 core
+es 1 1 1 cpp
+es 1 1 1 cs
+es 1 1 1 csproj
+eg 1 1 1 csv
+eg 1 1 1 dat
+eg 1 1 1 db
+es 1 1 1 dll
+eg 1 1 1 do
+es 1 1 1 doc
+eg 1 1 1 dump
+es 1 1 1 ep
+eg 1 1 1 err
+eg 1 1 1 error
+es 1 1 1 exe
+es 1 1 1 fcgi
+es 1 1 1 gif
+eg 1 1 1 gz
+es 1 1 1 htm
+es 1 1 1 html
+es 1 1 1 inc
+es 1 1 1 ini
+es 1 1 1 jar
+es 1 1 1 java
+es 1 1 1 jhtml
+es 1 1 1 jpg
+es 1 1 1 js
+es 1 1 1 jsf
+es 1 1 1 jsp
+eg 1 1 1 key
+eg 1 1 1 lib
+eg 1 1 1 log
+eg 1 1 1 lst
+es 1 1 1 manifest
+eg 1 1 1 mdb
+eg 1 1 1 meta
+eg 1 1 1 msg
+es 1 1 1 nsf
+eg 1 1 1 o
+eg 1 1 1 old
+eg 1 1 1 ora
+eg 1 1 1 orig
+eg 1 1 1 out
+eg 1 1 1 part
+es 1 1 1 pdf
+es 1 1 1 pem
+es 1 1 1 pfx
+es 1 1 1 php
+es 1 1 1 php3
+es 1 1 1 phps
+es 1 1 1 phtml
+es 1 1 1 pl
+es 1 1 1 pm
+es 1 1 1 png
+es 1 1 1 ppt
+eg 1 1 1 properties
+es 1 1 1 py
+eg 1 1 1 rar
+es 1 1 1 rb
+es 1 1 1 rhtml
+es 1 1 1 rss
+es 1 1 1 rtf
+eg 1 1 1 save
+es 1 1 1 sh
+es 1 1 1 shtml
+es 1 1 1 so
+es 1 1 1 sql
+eg 1 1 1 stackdump
+es 1 1 1 svn-base
+es 1 1 1 swf
+eg 1 1 1 tar
+eg 1 1 1 tar.bz2
+eg 1 1 1 tar.gz
+eg 1 1 1 temp
+eg 1 1 1 test
+eg 1 1 1 tgz
+eg 1 1 1 tmp
+es 1 1 1 tpl
+eg 1 1 1 trace
+eg 1 1 1 txt
+es 1 1 1 vb
+es 1 1 1 vbs
+es 1 1 1 war
+es 1 1 1 ws
+es 1 1 1 xls
+eg 1 1 1 xml
+es 1 1 1 xsl
+es 1 1 1 xslt
+es 1 1 1 yml
+eg 1 1 1 zip
+ws 1 1 1 .bash_history
+ws 1 1 1 .bashrc
+ws 1 1 1 .cvsignore
+ws 1 1 1 .history
+ws 1 1 1 .htaccess
+ws 1 1 1 .htpasswd
+ws 1 1 1 .passwd
+ws 1 1 1 .perf
+ws 1 1 1 .ssh
+ws 1 1 1 .svn
+ws 1 1 1 .web
+wg 1 1 1 0
+wg 1 1 1 00
+wg 1 1 1 01
+wg 1 1 1 02
+wg 1 1 1 03
+wg 1 1 1 04
+wg 1 1 1 05
+wg 1 1 1 06
+wg 1 1 1 07
+wg 1 1 1 08
+wg 1 1 1 09
+wg 1 1 1 1
+wg 1 1 1 10
+wg 1 1 1 100
+wg 1 1 1 1000
+wg 1 1 1 1001
+wg 1 1 1 101
+wg 1 1 1 11
+wg 1 1 1 12
+wg 1 1 1 13
+wg 1 1 1 14
+wg 1 1 1 15
+wg 1 1 1 1990
+wg 1 1 1 1991
+wg 1 1 1 1992
+wg 1 1 1 1993
+wg 1 1 1 1994
+wg 1 1 1 1995
+wg 1 1 1 1996
+wg 1 1 1 1997
+wg 1 1 1 1998
+wg 1 1 1 1999
+wg 1 1 1 2
+wg 1 1 1 20
+wg 1 1 1 200
+wg 1 1 1 2000
+wg 1 1 1 2001
+wg 1 1 1 2002
+wg 1 1 1 2003
+wg 1 1 1 2004
+wg 1 1 1 2005
+wg 1 1 1 2006
+wg 1 1 1 2007
+wg 1 1 1 2008
+wg 1 1 1 2009
+wg 1 1 1 2010
+wg 1 1 1 2011
+wg 1 1 1 2012
+wg 1 1 1 2013
+wg 1 1 1 2014
+wg 1 1 1 21
+wg 1 1 1 22
+wg 1 1 1 23
+wg 1 1 1 24
+wg 1 1 1 25
+wg 1 1 1 2g
+wg 1 1 1 3
+wg 1 1 1 300
+wg 1 1 1 3g
+wg 1 1 1 4
+wg 1 1 1 42
+wg 1 1 1 5
+wg 1 1 1 50
+wg 1 1 1 500
+wg 1 1 1 51
+wg 1 1 1 6
+wg 1 1 1 7
+wg 1 1 1 8
+wg 1 1 1 9
+wg 1 1 1 ADM
+wg 1 1 1 ADMIN
+wg 1 1 1 Admin
+wg 1 1 1 AdminService
+wg 1 1 1 AggreSpy
+wg 1 1 1 AppsLocalLogin
+wg 1 1 1 AppsLogin
+ws 1 1 1 BUILD
+wg 1 1 1 CMS
+wg 1 1 1 CVS
+wg 1 1 1 DB
+wg 1 1 1 DMSDump
+ws 1 1 1 Documents and Settings
+ws 1 1 1 Entries
+wg 1 1 1 FCKeditor
+wg 1 1 1 JMXSoapAdapter
+wg 1 1 1 LICENSE
+ws 1 1 1 MANIFEST.MF
+ws 1 1 1 META-INF
+ws 1 1 1 Makefile
+wg 1 1 1 OA
+wg 1 1 1 OAErrorDetailPage
+ws 1 1 1 OA_HTML
+ws 1 1 1 Program Files
+wg 1 1 1 README
+ws 1 1 1 Rakefile
+wg 1 1 1 Readme
+ws 1 1 1 Recycled
+wg 1 1 1 Root
+ws 1 1 1 SERVER-INF
+wg 1 1 1 SOAPMonitor
+wg 1 1 1 SQL
+wg 1 1 1 SUNWmc
+wg 1 1 1 SiteScope
+wg 1 1 1 SiteServer
+wg 1 1 1 Spy
+wg 1 1 1 TEMP
+wg 1 1 1 TMP
+wg 1 1 1 TODO
+ws 1 1 1 Thumbs.db
+ws 1 1 1 WEB-INF
+ws 1 1 1 WS_FTP
+wg 1 1 1 XXX
+ws 1 1 1 _
+ws 1 1 1 _adm
+ws 1 1 1 _admin
+ws 1 1 1 _common
+ws 1 1 1 _conf
+ws 1 1 1 _files
+ws 1 1 1 _include
+ws 1 1 1 _js
+ws 1 1 1 _mem_bin
+ws 1 1 1 _old
+ws 1 1 1 _pages
+ws 1 1 1 _private
+ws 1 1 1 _res
+ws 1 1 1 _source
+ws 1 1 1 _src
+ws 1 1 1 _test
+ws 1 1 1 _vti_bin
+ws 1 1 1 _vti_cnf
+ws 1 1 1 _vti_pvt
+ws 1 1 1 _vti_txt
+ws 1 1 1 _www
+wg 1 1 1 a
+wg 1 1 1 aa
+wg 1 1 1 aaa
+wg 1 1 1 abc
+wg 1 1 1 abc123
+wg 1 1 1 abcd
+wg 1 1 1 abcd1234
+wg 1 1 1 about
+wg 1 1 1 access
+ws 1 1 1 access-log
+ws 1 1 1 access-log.1
+ws 1 1 1 access.1
+ws 1 1 1 access_log
+ws 1 1 1 access_log.1
+wg 1 1 1 accessibility
+wg 1 1 1 account
+wg 1 1 1 accounting
+wg 1 1 1 accounts
+wg 1 1 1 action
+wg 1 1 1 actions
+wg 1 1 1 active
+wg 1 1 1 activex
+wg 1 1 1 ad
+wg 1 1 1 adclick
+wg 1 1 1 add
+wg 1 1 1 addpost
+wg 1 1 1 addressbook
+wg 1 1 1 adm
+wg 1 1 1 admin
+wg 1 1 1 admin-console
+ws 1 1 1 admin_
+wg 1 1 1 admins
+wg 1 1 1 adobe
+wg 1 1 1 adodb
+wg 1 1 1 ads
+wg 1 1 1 adv
+wg 1 1 1 advanced
+wg 1 1 1 advertise
+wg 1 1 1 advertising
+wg 1 1 1 affiliate
+wg 1 1 1 affiliates
+wg 1 1 1 agenda
+wg 1 1 1 agent
+wg 1 1 1 agents
+wg 1 1 1 ajax
+wg 1 1 1 akamai
+wg 1 1 1 album
+wg 1 1 1 albums
+wg 1 1 1 alcatel
+wg 1 1 1 alert
+wg 1 1 1 alerts
+wg 1 1 1 alias
+wg 1 1 1 aliases
+wg 1 1 1 all
+wg 1 1 1 all-wcprops
+wg 1 1 1 alpha
+wg 1 1 1 alumni
+wg 1 1 1 amanda
+wg 1 1 1 amazon
+wg 1 1 1 analog
+wg 1 1 1 android
+wg 1 1 1 announcement
+wg 1 1 1 announcements
+wg 1 1 1 annual
+wg 1 1 1 anon
+wg 1 1 1 anonymous
+wg 1 1 1 ansi
+wg 1 1 1 apac
+wg 1 1 1 apache
+wg 1 1 1 apexec
+wg 1 1 1 api
+wg 1 1 1 apis
+wg 1 1 1 app
+wg 1 1 1 appeal
+wg 1 1 1 appeals
+wg 1 1 1 append
+wg 1 1 1 appl
+wg 1 1 1 apple
+wg 1 1 1 appliation
+wg 1 1 1 applications
+wg 1 1 1 apps
+wg 1 1 1 apr
+wg 1 1 1 arch
+wg 1 1 1 archive
+wg 1 1 1 archives
+wg 1 1 1 array
+wg 1 1 1 art
+wg 1 1 1 article
+wg 1 1 1 articles
+wg 1 1 1 artwork
+wg 1 1 1 ascii
+wg 1 1 1 asdf
+wg 1 1 1 ashley
+wg 1 1 1 asset
+wg 1 1 1 assets
+wg 1 1 1 atom
+wg 1 1 1 attach
+wg 1 1 1 attachment
+wg 1 1 1 attachments
+wg 1 1 1 attachs
+wg 1 1 1 attic
+wg 1 1 1 auction
+wg 1 1 1 audio
+wg 1 1 1 audit
+wg 1 1 1 audits
+wg 1 1 1 auth
+wg 1 1 1 author
+ws 1 1 1 authorized_keys
+wg 1 1 1 authors
+wg 1 1 1 auto
+wg 1 1 1 automatic
+wg 1 1 1 automation
+wg 1 1 1 avatar
+wg 1 1 1 avatars
+wg 1 1 1 award
+wg 1 1 1 awards
+wg 1 1 1 awl
+wg 1 1 1 awstats
+ws 1 1 1 axis
+ws 1 1 1 axis-admin
+ws 1 1 1 axis2
+ws 1 1 1 axis2-admin
+wg 1 1 1 b
+wg 1 1 1 b2b
+wg 1 1 1 b2c
+wg 1 1 1 back
+wg 1 1 1 backdoor
+wg 1 1 1 backend
+wg 1 1 1 backup
+wg 1 1 1 backup-db
+wg 1 1 1 backups
+wg 1 1 1 balance
+wg 1 1 1 balances
+wg 1 1 1 bandwidth
+wg 1 1 1 bank
+wg 1 1 1 banking
+wg 1 1 1 banks
+wg 1 1 1 banner
+wg 1 1 1 banners
+wg 1 1 1 bar
+wg 1 1 1 base
+wg 1 1 1 bash
+wg 1 1 1 basic
+wg 1 1 1 basket
+wg 1 1 1 baskets
+wg 1 1 1 batch
+wg 1 1 1 baz
+wg 1 1 1 bb
+wg 1 1 1 bb-hist
+wg 1 1 1 bb-histlog
+wg 1 1 1 bboard
+wg 1 1 1 bbs
+wg 1 1 1 bean
+wg 1 1 1 beans
+wg 1 1 1 beehive
+wg 1 1 1 benefits
+wg 1 1 1 beta
+wg 1 1 1 bfc
+wg 1 1 1 big
+wg 1 1 1 bigip
+wg 1 1 1 bill
+wg 1 1 1 billing
+wg 1 1 1 binaries
+wg 1 1 1 binary
+wg 1 1 1 bins
+wg 1 1 1 bio
+wg 1 1 1 bios
+wg 1 1 1 biz
+wg 1 1 1 bkup
+wg 1 1 1 blah
+wg 1 1 1 blank
+wg 1 1 1 blog
+wg 1 1 1 blogger
+wg 1 1 1 bloggers
+wg 1 1 1 blogs
+wg 1 1 1 blogspot
+wg 1 1 1 board
+wg 1 1 1 boards
+wg 1 1 1 bob
+wg 1 1 1 bofh
+wg 1 1 1 book
+wg 1 1 1 books
+wg 1 1 1 boot
+wg 1 1 1 bottom
+wg 1 1 1 broken
+wg 1 1 1 broker
+wg 1 1 1 browse
+wg 1 1 1 browser
+wg 1 1 1 bs
+wg 1 1 1 bsd
+wg 1 1 1 bug
+wg 1 1 1 bugs
+wg 1 1 1 build
+wg 1 1 1 builder
+wg 1 1 1 buildr
+wg 1 1 1 bulk
+wg 1 1 1 bullet
+wg 1 1 1 business
+wg 1 1 1 button
+wg 1 1 1 buttons
+wg 1 1 1 buy
+wg 1 1 1 buynow
+wg 1 1 1 bypass
+wg 1 1 1 ca
+wg 1 1 1 cache
+wg 1 1 1 cal
+wg 1 1 1 calendar
+wg 1 1 1 camel
+wg 1 1 1 car
+wg 1 1 1 card
+wg 1 1 1 cards
+wg 1 1 1 career
+wg 1 1 1 careers
+wg 1 1 1 cars
+wg 1 1 1 cart
+wg 1 1 1 carts
+wg 1 1 1 cat
+wg 1 1 1 catalog
+wg 1 1 1 catalogs
+wg 1 1 1 catalyst
+wg 1 1 1 categories
+wg 1 1 1 category
+wg 1 1 1 catinfo
+wg 1 1 1 cats
+wg 1 1 1 ccbill
+wg 1 1 1 cd
+wg 1 1 1 cert
+wg 1 1 1 certificate
+wg 1 1 1 certificates
+wg 1 1 1 certified
+wg 1 1 1 certs
+wg 1 1 1 cf
+wg 1 1 1 cfcache
+wg 1 1 1 cfdocs
+wg 1 1 1 cfide
+wg 1 1 1 cfusion
+ws 1 1 1 cgi-bin
+ws 1 1 1 cgi-bin2
+ws 1 1 1 cgi-home
+ws 1 1 1 cgi-local
+ws 1 1 1 cgi-pub
+ws 1 1 1 cgi-script
+ws 1 1 1 cgi-shl
+ws 1 1 1 cgi-sys
+ws 1 1 1 cgi-web
+ws 1 1 1 cgi-win
+ws 1 1 1 cgibin
+ws 1 1 1 cgiwrap
+ws 1 1 1 cgm-web
+wg 1 1 1 change
+wg 1 1 1 changed
+wg 1 1 1 changes
+wg 1 1 1 charge
+wg 1 1 1 charges
+wg 1 1 1 chat
+wg 1 1 1 chats
+wg 1 1 1 check
+wg 1 1 1 checking
+wg 1 1 1 checkout
+wg 1 1 1 checkpoint
+wg 1 1 1 checks
+wg 1 1 1 child
+wg 1 1 1 children
+wg 1 1 1 chris
+wg 1 1 1 chrome
+wg 1 1 1 cisco
+wg 1 1 1 cisweb
+wg 1 1 1 citrix
+wg 1 1 1 cl
+wg 1 1 1 claim
+wg 1 1 1 claims
+wg 1 1 1 classes
+wg 1 1 1 classified
+wg 1 1 1 classifieds
+wg 1 1 1 clear
+wg 1 1 1 click
+wg 1 1 1 clicks
+wg 1 1 1 client
+wg 1 1 1 clientaccesspolicy
+wg 1 1 1 clients
+wg 1 1 1 clk
+wg 1 1 1 clock
+wg 1 1 1 close
+wg 1 1 1 closed
+wg 1 1 1 closing
+wg 1 1 1 club
+wg 1 1 1 cluster
+wg 1 1 1 clusters
+wg 1 1 1 cmd
+wg 1 1 1 cms
+wg 1 1 1 cnt
+wg 1 1 1 cocoon
+wg 1 1 1 code
+wg 1 1 1 codec
+wg 1 1 1 codecs
+wg 1 1 1 codes
+wg 1 1 1 cognos
+wg 1 1 1 coldfusion
+wg 1 1 1 columns
+wg 1 1 1 com
+wg 1 1 1 comment
+wg 1 1 1 comments
+wg 1 1 1 commerce
+wg 1 1 1 commercial
+wg 1 1 1 common
+wg 1 1 1 communicator
+wg 1 1 1 community
+wg 1 1 1 compact
+wg 1 1 1 company
+wg 1 1 1 compat
+wg 1 1 1 complaint
+wg 1 1 1 complaints
+wg 1 1 1 compliance
+wg 1 1 1 component
+wg 1 1 1 components
+wg 1 1 1 compress
+wg 1 1 1 compressed
+wg 1 1 1 computer
+wg 1 1 1 computers
+wg 1 1 1 computing
+wg 1 1 1 conference
+wg 1 1 1 conferences
+wg 1 1 1 configs
+wg 1 1 1 console
+wg 1 1 1 consumer
+wg 1 1 1 contact
+wg 1 1 1 contacts
+wg 1 1 1 content
+wg 1 1 1 contents
+wg 1 1 1 contest
+wg 1 1 1 contract
+wg 1 1 1 contracts
+wg 1 1 1 control
+wg 1 1 1 controller
+wg 1 1 1 controlpanel
+wg 1 1 1 cookie
+wg 1 1 1 cookies
+wg 1 1 1 copies
+wg 1 1 1 copy
+wg 1 1 1 copyright
+wg 1 1 1 corp
+wg 1 1 1 corpo
+wg 1 1 1 corporate
+wg 1 1 1 corrections
+wg 1 1 1 count
+wg 1 1 1 counter
+wg 1 1 1 counters
+wg 1 1 1 counts
+wg 1 1 1 course
+wg 1 1 1 courses
+wg 1 1 1 cover
+wg 1 1 1 cpadmin
+wg 1 1 1 cpanel
+wg 1 1 1 cr
+wg 1 1 1 crack
+wg 1 1 1 crash
+wg 1 1 1 crashes
+wg 1 1 1 create
+wg 1 1 1 creator
+wg 1 1 1 credit
+wg 1 1 1 credits
+wg 1 1 1 crm
+wg 1 1 1 cron
+wg 1 1 1 crons
+wg 1 1 1 crontab
+wg 1 1 1 crontabs
+wg 1 1 1 crossdomain
+wg 1 1 1 crypt
+wg 1 1 1 crypto
+wg 1 1 1 css
+wg 1 1 1 current
+wg 1 1 1 custom
+ws 1 1 1 custom-log
+ws 1 1 1 custom_log
+wg 1 1 1 customer
+wg 1 1 1 customers
+wg 1 1 1 cute
+wg 1 1 1 cv
+wg 1 1 1 cxf
+wg 1 1 1 czcmdcvt
+wg 1 1 1 d
+wg 1 1 1 daemon
+wg 1 1 1 daily
+wg 1 1 1 dan
+wg 1 1 1 dana-na
+wg 1 1 1 data
+wg 1 1 1 database
+wg 1 1 1 databases
+wg 1 1 1 date
+wg 1 1 1 day
+wg 1 1 1 db_connect
+wg 1 1 1 dba
+wg 1 1 1 dbase
+wg 1 1 1 dblclk
+wg 1 1 1 dbman
+wg 1 1 1 dbmodules
+wg 1 1 1 dbutil
+wg 1 1 1 dc
+wg 1 1 1 dcforum
+wg 1 1 1 dclk
+wg 1 1 1 de
+wg 1 1 1 dealer
+wg 1 1 1 debug
+wg 1 1 1 decl
+wg 1 1 1 declaration
+wg 1 1 1 declarations
+wg 1 1 1 decode
+wg 1 1 1 decoder
+wg 1 1 1 decrypt
+wg 1 1 1 decrypted
+wg 1 1 1 decryption
+wg 1 1 1 def
+wg 1 1 1 default
+wg 1 1 1 defaults
+wg 1 1 1 definition
+wg 1 1 1 definitions
+wg 1 1 1 del
+wg 1 1 1 delete
+wg 1 1 1 deleted
+wg 1 1 1 demo
+wg 1 1 1 demos
+wg 1 1 1 denied
+wg 1 1 1 deny
+wg 1 1 1 design
+wg 1 1 1 desktop
+wg 1 1 1 desktops
+wg 1 1 1 detail
+wg 1 1 1 details
+wg 1 1 1 dev
+wg 1 1 1 devel
+wg 1 1 1 developer
+wg 1 1 1 developers
+wg 1 1 1 development
+wg 1 1 1 device
+wg 1 1 1 devices
+wg 1 1 1 devs
+wg 1 1 1 df
+wg 1 1 1 dialog
+wg 1 1 1 dialogs
+wg 1 1 1 diff
+wg 1 1 1 diffs
+wg 1 1 1 digest
+wg 1 1 1 digg
+wg 1 1 1 dir
+ws 1 1 1 dir-prop-base
+wg 1 1 1 directories
+wg 1 1 1 directory
+wg 1 1 1 dirs
+wg 1 1 1 disabled
+wg 1 1 1 disclaimer
+wg 1 1 1 display
+wg 1 1 1 django
+wg 1 1 1 dl
+wg 1 1 1 dm
+wg 1 1 1 dm-config
+wg 1 1 1 dms
+wg 1 1 1 dms0
+wg 1 1 1 dns
+wg 1 1 1 docebo
+wg 1 1 1 dock
+wg 1 1 1 docroot
+wg 1 1 1 docs
+wg 1 1 1 document
+wg 1 1 1 documentation
+wg 1 1 1 documents
+wg 1 1 1 domain
+wg 1 1 1 domains
+wg 1 1 1 donate
+wg 1 1 1 done
+wg 1 1 1 doubleclick
+wg 1 1 1 down
+wg 1 1 1 download
+wg 1 1 1 downloader
+wg 1 1 1 downloads
+wg 1 1 1 drop
+wg 1 1 1 dropped
+wg 1 1 1 drupal
+wg 1 1 1 dummy
+wg 1 1 1 dumps
+wg 1 1 1 dvd
+wg 1 1 1 dwr
+wg 1 1 1 dyn
+wg 1 1 1 dynamic
+wg 1 1 1 e
+wg 1 1 1 e2fs
+wg 1 1 1 ear
+wg 1 1 1 ecommerce
+wg 1 1 1 edge
+wg 1 1 1 edit
+wg 1 1 1 editor
+wg 1 1 1 edits
+wg 1 1 1 edp
+wg 1 1 1 edu
+wg 1 1 1 education
+wg 1 1 1 ee
+wg 1 1 1 effort
+wg 1 1 1 efforts
+wg 1 1 1 egress
+wg 1 1 1 ejb
+wg 1 1 1 element
+wg 1 1 1 elements
+wg 1 1 1 em
+wg 1 1 1 email
+wg 1 1 1 emails
+wg 1 1 1 embed
+wg 1 1 1 embedded
+wg 1 1 1 emea
+wg 1 1 1 employees
+wg 1 1 1 employment
+wg 1 1 1 empty
+wg 1 1 1 emu
+wg 1 1 1 emulator
+wg 1 1 1 en
+ws 1 1 1 en_US
+wg 1 1 1 enc
+wg 1 1 1 encode
+wg 1 1 1 encoder
+wg 1 1 1 encrypt
+wg 1 1 1 encrypted
+wg 1 1 1 encyption
+wg 1 1 1 eng
+wg 1 1 1 engine
+wg 1 1 1 english
+wg 1 1 1 enterprise
+wg 1 1 1 entertainment
+wg 1 1 1 entries
+wg 1 1 1 entry
+wg 1 1 1 env
+wg 1 1 1 environ
+wg 1 1 1 environment
+wg 1 1 1 eric
+ws 1 1 1 error-log
+ws 1 1 1 error_log
+wg 1 1 1 errors
+wg 1 1 1 es
+wg 1 1 1 esale
+wg 1 1 1 esales
+wg 1 1 1 etc
+wg 1 1 1 eu
+wg 1 1 1 europe
+wg 1 1 1 event
+wg 1 1 1 events
+wg 1 1 1 evil
+wg 1 1 1 evt
+wg 1 1 1 ews
+wg 1 1 1 ex
+wg 1 1 1 example
+wg 1 1 1 examples
+wg 1 1 1 excalibur
+wg 1 1 1 exchange
+wg 1 1 1 exec
+wg 1 1 1 explorer
+wg 1 1 1 export
+wg 1 1 1 ext
+wg 1 1 1 ext2
+wg 1 1 1 extern
+wg 1 1 1 external
+wg 1 1 1 extras
+wg 1 1 1 ezshopper
+wg 1 1 1 f
+wg 1 1 1 fabric
+wg 1 1 1 face
+wg 1 1 1 facebook
+wg 1 1 1 faces
+wg 1 1 1 faculty
+wg 1 1 1 fail
+wg 1 1 1 failure
+wg 1 1 1 fake
+wg 1 1 1 family
+wg 1 1 1 faq
+wg 1 1 1 faqs
+wg 1 1 1 favorite
+wg 1 1 1 favorites
+wg 1 1 1 fb
+wg 1 1 1 fbook
+wg 1 1 1 fc
+ws 1 1 1 fcgi-bin
+wg 1 1 1 feature
+wg 1 1 1 features
+wg 1 1 1 feed
+wg 1 1 1 feedback
+wg 1 1 1 feeds
+wg 1 1 1 felix
+wg 1 1 1 fetch
+wg 1 1 1 field
+wg 1 1 1 fields
+wg 1 1 1 file
+wg 1 1 1 fileadmin
+wg 1 1 1 filelist
+wg 1 1 1 files
+wg 1 1 1 filez
+wg 1 1 1 finance
+wg 1 1 1 financial
+wg 1 1 1 find
+wg 1 1 1 finger
+wg 1 1 1 firefox
+wg 1 1 1 firewall
+wg 1 1 1 firmware
+wg 1 1 1 first
+wg 1 1 1 fixed
+wg 1 1 1 flags
+wg 1 1 1 flash
+wg 1 1 1 flow
+wg 1 1 1 flows
+wg 1 1 1 flv
+wg 1 1 1 fn
+wg 1 1 1 folder
+wg 1 1 1 folders
+wg 1 1 1 font
+wg 1 1 1 fonts
+wg 1 1 1 foo
+wg 1 1 1 footer
+wg 1 1 1 footers
+wg 1 1 1 form
+wg 1 1 1 format
+wg 1 1 1 formatting
+wg 1 1 1 formmail
+wg 1 1 1 forms
+wg 1 1 1 forrest
+wg 1 1 1 fortune
+wg 1 1 1 forum
+wg 1 1 1 forum1
+wg 1 1 1 forum2
+wg 1 1 1 forumdisplay
+wg 1 1 1 forums
+wg 1 1 1 forward
+wg 1 1 1 foto
+wg 1 1 1 foundation
+wg 1 1 1 fr
+wg 1 1 1 frame
+wg 1 1 1 frames
+wg 1 1 1 framework
+wg 1 1 1 free
+wg 1 1 1 freebsd
+wg 1 1 1 friend
+wg 1 1 1 friends
+wg 1 1 1 frob
+wg 1 1 1 frontend
+wg 1 1 1 fs
+wg 1 1 1 ftp
+wg 1 1 1 fuck
+wg 1 1 1 fuckoff
+wg 1 1 1 fuckyou
+wg 1 1 1 full
+wg 1 1 1 fun
+wg 1 1 1 func
+wg 1 1 1 funcs
+wg 1 1 1 function
+wg 1 1 1 functions
+wg 1 1 1 fund
+wg 1 1 1 funding
+wg 1 1 1 funds
+wg 1 1 1 fusion
+wg 1 1 1 fw
+wg 1 1 1 g
+wg 1 1 1 gadget
+wg 1 1 1 gadgets
+wg 1 1 1 galleries
+wg 1 1 1 gallery
+wg 1 1 1 game
+wg 1 1 1 games
+wg 1 1 1 ganglia
+wg 1 1 1 garbage
+wg 1 1 1 gateway
+wg 1 1 1 gb
+wg 1 1 1 geeklog
+wg 1 1 1 general
+wg 1 1 1 geronimo
+wg 1 1 1 get
+wg 1 1 1 getaccess
+wg 1 1 1 getjobid
+wg 1 1 1 gfx
+wg 1 1 1 gid
+wg 1 1 1 git
+wg 1 1 1 gitweb
+wg 1 1 1 glimpse
+wg 1 1 1 global
+wg 1 1 1 globals
+wg 1 1 1 glossary
+wg 1 1 1 go
+wg 1 1 1 goaway
+wg 1 1 1 google
+wg 1 1 1 government
+wg 1 1 1 gprs
+wg 1 1 1 grant
+wg 1 1 1 grants
+wg 1 1 1 graphics
+wg 1 1 1 group
+wg 1 1 1 groupcp
+wg 1 1 1 groups
+wg 1 1 1 gsm
+wg 1 1 1 guest
+wg 1 1 1 guestbook
+wg 1 1 1 guests
+wg 1 1 1 guide
+wg 1 1 1 guides
+wg 1 1 1 gump
+wg 1 1 1 gwt
+wg 1 1 1 h
+wg 1 1 1 hack
+wg 1 1 1 hacker
+wg 1 1 1 hacking
+wg 1 1 1 hackme
+wg 1 1 1 hadoop
+wg 1 1 1 hardcore
+wg 1 1 1 hardware
+wg 1 1 1 harmony
+wg 1 1 1 head
+wg 1 1 1 header
+wg 1 1 1 headers
+wg 1 1 1 health
+wg 1 1 1 hello
+wg 1 1 1 help
+wg 1 1 1 helper
+wg 1 1 1 helpers
+wg 1 1 1 hi
+wg 1 1 1 hidden
+wg 1 1 1 hide
+wg 1 1 1 high
+wg 1 1 1 hipaa
+wg 1 1 1 hire
+wg 1 1 1 history
+wg 1 1 1 hit
+wg 1 1 1 hits
+wg 1 1 1 hole
+wg 1 1 1 home
+wg 1 1 1 homepage
+wg 1 1 1 hop
+wg 1 1 1 horde
+wg 1 1 1 hosting
+wg 1 1 1 hosts
+wg 1 1 1 hour
+wg 1 1 1 hourly
+wg 1 1 1 howto
+wg 1 1 1 hp
+wg 1 1 1 hr
+wg 1 1 1 hta
+ws 1 1 1 htbin
+ws 1 1 1 htdoc
+ws 1 1 1 htdocs
+wg 1 1 1 htpasswd
+wg 1 1 1 http
+wg 1 1 1 httpd
+wg 1 1 1 https
+wg 1 1 1 httpuser
+wg 1 1 1 hu
+wg 1 1 1 hyper
+wg 1 1 1 i
+wg 1 1 1 ia
+wg 1 1 1 ibm
+wg 1 1 1 icat
+wg 1 1 1 ico
+wg 1 1 1 icon
+wg 1 1 1 icons
+wg 1 1 1 id
+wg 1 1 1 idea
+wg 1 1 1 ideas
+wg 1 1 1 ids
+wg 1 1 1 ie
+wg 1 1 1 iframe
+wg 1 1 1 ig
+wg 1 1 1 ignore
+wg 1 1 1 iisadmin
+ws 1 1 1 iisadmpwd
+ws 1 1 1 iissamples
+wg 1 1 1 image
+wg 1 1 1 imagefolio
+wg 1 1 1 images
+wg 1 1 1 img
+wg 1 1 1 imgs
+wg 1 1 1 imp
+wg 1 1 1 import
+wg 1 1 1 important
+wg 1 1 1 in
+wg 1 1 1 inbound
+wg 1 1 1 incl
+wg 1 1 1 include
+wg 1 1 1 includes
+wg 1 1 1 incoming
+wg 1 1 1 incubator
+wg 1 1 1 index
+wg 1 1 1 index1
+wg 1 1 1 index2
+wg 1 1 1 index_1
+wg 1 1 1 index_2
+wg 1 1 1 inetpub
+wg 1 1 1 inetsrv
+wg 1 1 1 inf
+wg 1 1 1 info
+wg 1 1 1 information
+wg 1 1 1 ingress
+wg 1 1 1 init
+wg 1 1 1 inline
+wg 1 1 1 input
+wg 1 1 1 inquire
+wg 1 1 1 inquiries
+wg 1 1 1 inquiry
+wg 1 1 1 insert
+wg 1 1 1 install
+wg 1 1 1 int
+wg 1 1 1 intel
+wg 1 1 1 intelligence
+wg 1 1 1 inter
+wg 1 1 1 interim
+wg 1 1 1 intermediate
+wg 1 1 1 internal
+wg 1 1 1 international
+wg 1 1 1 internet
+wg 1 1 1 intl
+wg 1 1 1 intra
+wg 1 1 1 intranet
+wg 1 1 1 intro
+wg 1 1 1 ip
+wg 1 1 1 ipc
+wg 1 1 1 iphone
+wg 1 1 1 ips
+wg 1 1 1 irc
+wg 1 1 1 is
+wg 1 1 1 isapi
+wg 1 1 1 iso
+wg 1 1 1 issues
+wg 1 1 1 it
+wg 1 1 1 item
+wg 1 1 1 items
+wg 1 1 1 j
+wg 1 1 1 j2ee
+wg 1 1 1 j2me
+wg 1 1 1 jacob
+wg 1 1 1 jakarta
+wg 1 1 1 java-plugin
+wg 1 1 1 javadoc
+wg 1 1 1 javascript
+wg 1 1 1 javax
+wg 1 1 1 jboss
+wg 1 1 1 jbossas
+wg 1 1 1 jbossws
+wg 1 1 1 jdbc
+wg 1 1 1 jennifer
+wg 1 1 1 jessica
+wg 1 1 1 jigsaw
+wg 1 1 1 jira
+wg 1 1 1 jj
+ws 1 1 1 jmx-console
+wg 1 1 1 job
+wg 1 1 1 jobs
+wg 1 1 1 joe
+wg 1 1 1 john
+wg 1 1 1 join
+wg 1 1 1 joomla
+wg 1 1 1 journal
+wg 1 1 1 jp
+wg 1 1 1 jpa
+wg 1 1 1 jre
+wg 1 1 1 jrun
+wg 1 1 1 json
+wg 1 1 1 jsso
+wg 1 1 1 jsx
+wg 1 1 1 juniper
+wg 1 1 1 junk
+wg 1 1 1 jvm
+wg 1 1 1 k
+wg 1 1 1 kboard
+wg 1 1 1 keep
+wg 1 1 1 kernel
+wg 1 1 1 keygen
+wg 1 1 1 keys
+wg 1 1 1 kids
+wg 1 1 1 kill
+ws 1 1 1 known_hosts
+wg 1 1 1 l
+wg 1 1 1 la
+wg 1 1 1 labs
+wg 1 1 1 lang
+wg 1 1 1 large
+wg 1 1 1 law
+wg 1 1 1 layout
+wg 1 1 1 layouts
+wg 1 1 1 ldap
+wg 1 1 1 leader
+wg 1 1 1 leaders
+wg 1 1 1 left
+wg 1 1 1 legacy
+wg 1 1 1 legal
+wg 1 1 1 lenya
+wg 1 1 1 letters
+wg 1 1 1 level
+wg 1 1 1 lg
+wg 1 1 1 library
+wg 1 1 1 libs
+wg 1 1 1 license
+wg 1 1 1 licenses
+wg 1 1 1 limit
+wg 1 1 1 line
+wg 1 1 1 link
+wg 1 1 1 links
+wg 1 1 1 linux
+wg 1 1 1 list
+wg 1 1 1 listinfo
+wg 1 1 1 lists
+wg 1 1 1 live
+wg 1 1 1 lo
+wg 1 1 1 loader
+wg 1 1 1 loading
+wg 1 1 1 loc
+wg 1 1 1 local
+wg 1 1 1 location
+wg 1 1 1 lock
+wg 1 1 1 locked
+wg 1 1 1 log4j
+wg 1 1 1 log4net
+wg 1 1 1 logfile
+wg 1 1 1 logger
+wg 1 1 1 logging
+wg 1 1 1 login
+wg 1 1 1 logins
+wg 1 1 1 logo
+wg 1 1 1 logoff
+wg 1 1 1 logon
+wg 1 1 1 logos
+wg 1 1 1 logout
+wg 1 1 1 logs
+wg 1 1 1 lost
+ws 1 1 1 lost+found
+wg 1 1 1 low
+wg 1 1 1 ls
+wg 1 1 1 lucene
+wg 1 1 1 m
+wg 1 1 1 mac
+wg 1 1 1 macromedia
+wg 1 1 1 maestro
+wg 1 1 1 mail
+wg 1 1 1 mailer
+wg 1 1 1 mailing
+wg 1 1 1 mailman
+wg 1 1 1 mails
+wg 1 1 1 main
+wg 1 1 1 mambo
+wg 1 1 1 manage
+wg 1 1 1 managed
+wg 1 1 1 management
+wg 1 1 1 manager
+wg 1 1 1 manual
+wg 1 1 1 manuals
+wg 1 1 1 map
+wg 1 1 1 maps
+wg 1 1 1 mark
+wg 1 1 1 marketing
+wg 1 1 1 master
+ws 1 1 1 master.passwd
+wg 1 1 1 match
+wg 1 1 1 matrix
+wg 1 1 1 matt
+wg 1 1 1 maven
+wg 1 1 1 mbox
+wg 1 1 1 me
+wg 1 1 1 media
+wg 1 1 1 medium
+wg 1 1 1 mem
+wg 1 1 1 member
+wg 1 1 1 members
+wg 1 1 1 membership
+wg 1 1 1 memory
+wg 1 1 1 menu
+wg 1 1 1 menus
+wg 1 1 1 message
+wg 1 1 1 messages
+wg 1 1 1 messaging
+wg 1 1 1 michael
+wg 1 1 1 microsoft
+wg 1 1 1 migrate
+wg 1 1 1 migrated
+wg 1 1 1 migration
+wg 1 1 1 mina
+wg 1 1 1 mini
+wg 1 1 1 minute
+wg 1 1 1 mirror
+wg 1 1 1 mirrors
+wg 1 1 1 misc
+wg 1 1 1 mission
+wg 1 1 1 mix
+wg 1 1 1 mlist
+wg 1 1 1 mms
+wg 1 1 1 mobi
+wg 1 1 1 mobile
+wg 1 1 1 mock
+wg 1 1 1 mod
+wg 1 1 1 modify
+wg 1 1 1 mods
+wg 1 1 1 module
+wg 1 1 1 modules
+wg 1 1 1 mojo
+wg 1 1 1 money
+wg 1 1 1 monitor
+wg 1 1 1 monitoring
+wg 1 1 1 monitors
+wg 1 1 1 month
+wg 1 1 1 monthly
+wg 1 1 1 more
+wg 1 1 1 motd
+wg 1 1 1 move
+wg 1 1 1 moved
+wg 1 1 1 movie
+wg 1 1 1 movies
+wg 1 1 1 mp
+wg 1 1 1 mp3
+wg 1 1 1 mp3s
+wg 1 1 1 ms
+wg 1 1 1 ms-sql
+wg 1 1 1 msadc
+wg 1 1 1 msadm
+wg 1 1 1 msft
+wg 1 1 1 msie
+wg 1 1 1 msql
+wg 1 1 1 mssql
+wg 1 1 1 mta
+wg 1 1 1 multi
+wg 1 1 1 multimedia
+wg 1 1 1 music
+wg 1 1 1 mx
+wg 1 1 1 my
+wg 1 1 1 myadmin
+wg 1 1 1 myfaces
+wg 1 1 1 myphpnuke
+wg 1 1 1 mysql
+wg 1 1 1 mysqld
+wg 1 1 1 n
+wg 1 1 1 nav
+wg 1 1 1 navigation
+wg 1 1 1 nc
+wg 1 1 1 net
+wg 1 1 1 netbsd
+wg 1 1 1 netcat
+wg 1 1 1 nethome
+wg 1 1 1 nets
+wg 1 1 1 network
+wg 1 1 1 networking
+wg 1 1 1 new
+wg 1 1 1 news
+wg 1 1 1 newsletter
+wg 1 1 1 newsletters
+wg 1 1 1 newticket
+wg 1 1 1 next
+wg 1 1 1 nfs
+wg 1 1 1 nice
+wg 1 1 1 nl
+wg 1 1 1 nobody
+wg 1 1 1 node
+wg 1 1 1 none
+wg 1 1 1 note
+wg 1 1 1 notes
+wg 1 1 1 notification
+wg 1 1 1 notifications
+wg 1 1 1 notified
+wg 1 1 1 notifier
+wg 1 1 1 notify
+wg 1 1 1 novell
+wg 1 1 1 ns
+wg 1 1 1 nude
+wg 1 1 1 nuke
+wg 1 1 1 nul
+wg 1 1 1 null
+ws 1 1 1 oa_servlets
+wg 1 1 1 oauth
+wg 1 1 1 obdc
+wg 1 1 1 obsolete
+wg 1 1 1 obsoleted
+wg 1 1 1 odbc
+wg 1 1 1 ode
+wg 1 1 1 oem
+wg 1 1 1 ofbiz
+wg 1 1 1 office
+wg 1 1 1 offices
+wg 1 1 1 onbound
+wg 1 1 1 online
+wg 1 1 1 op
+wg 1 1 1 open
+wg 1 1 1 openbsd
+wg 1 1 1 opencart
+wg 1 1 1 opendir
+wg 1 1 1 openejb
+wg 1 1 1 openjpa
+wg 1 1 1 opera
+wg 1 1 1 operations
+wg 1 1 1 opinion
+ws 1 1 1 oprocmgr-status
+wg 1 1 1 opt
+wg 1 1 1 option
+wg 1 1 1 options
+wg 1 1 1 oracle
+ws 1 1 1 oracle.xml.xsql.XSQLServlet
+wg 1 1 1 order
+wg 1 1 1 ordered
+wg 1 1 1 orders
+wg 1 1 1 org
+wg 1 1 1 osc
+wg 1 1 1 oscommerce
+wg 1 1 1 other
+wg 1 1 1 outcome
+wg 1 1 1 outgoing
+wg 1 1 1 outline
+wg 1 1 1 output
+wg 1 1 1 outreach
+wg 1 1 1 overview
+wg 1 1 1 owa
+wg 1 1 1 owl
+wg 1 1 1 ows
+ws 1 1 1 ows-bin
+wg 1 1 1 p
+wg 1 1 1 p2p
+wg 1 1 1 pack
+wg 1 1 1 package
+wg 1 1 1 packaged
+wg 1 1 1 packages
+wg 1 1 1 packed
+wg 1 1 1 page
+wg 1 1 1 page1
+wg 1 1 1 page2
+wg 1 1 1 page_1
+wg 1 1 1 page_2
+wg 1 1 1 pages
+wg 1 1 1 paid
+wg 1 1 1 panel
+wg 1 1 1 paper
+wg 1 1 1 papers
+wg 1 1 1 parse
+wg 1 1 1 partner
+wg 1 1 1 partners
+wg 1 1 1 party
+wg 1 1 1 pass
+wg 1 1 1 passive
+wg 1 1 1 passwd
+wg 1 1 1 password
+wg 1 1 1 passwords
+wg 1 1 1 past
+wg 1 1 1 patch
+wg 1 1 1 patches
+wg 1 1 1 pay
+wg 1 1 1 payment
+wg 1 1 1 payments
+wg 1 1 1 paypal
+wg 1 1 1 pbo
+wg 1 1 1 pc
+wg 1 1 1 pci
+wg 1 1 1 pda
+wg 1 1 1 pdfs
+wg 1 1 1 pear
+wg 1 1 1 peek
+wg 1 1 1 pending
+wg 1 1 1 people
+wg 1 1 1 perf
+wg 1 1 1 performance
+wg 1 1 1 perl
+wg 1 1 1 personal
+wg 1 1 1 pg
+wg 1 1 1 phf
+wg 1 1 1 phone
+wg 1 1 1 phones
+wg 1 1 1 phorum
+wg 1 1 1 photo
+wg 1 1 1 photos
+ws 1 1 1 phpBB
+ws 1 1 1 phpBB2
+ws 1 1 1 phpEventCalendar
+ws 1 1 1 phpMyAdmin
+ws 1 1 1 phpbb
+ws 1 1 1 phpmyadmin
+ws 1 1 1 phpnuke
+wg 1 1 1 phps
+wg 1 1 1 pic
+wg 1 1 1 pics
+wg 1 1 1 pictures
+wg 1 1 1 pii
+wg 1 1 1 ping
+wg 1 1 1 pipe
+wg 1 1 1 pipermail
+wg 1 1 1 piranha
+wg 1 1 1 pivot
+wg 1 1 1 pix
+wg 1 1 1 pixel
+wg 1 1 1 pkg
+wg 1 1 1 pkgs
+wg 1 1 1 plain
+wg 1 1 1 play
+wg 1 1 1 player
+wg 1 1 1 playing
+wg 1 1 1 playlist
+wg 1 1 1 pls
+wg 1 1 1 plugin
+wg 1 1 1 plugins
+wg 1 1 1 poc
+wg 1 1 1 poi
+wg 1 1 1 policies
+wg 1 1 1 policy
+wg 1 1 1 politics
+wg 1 1 1 poll
+wg 1 1 1 polls
+wg 1 1 1 pool
+wg 1 1 1 pop
+wg 1 1 1 pop3
+wg 1 1 1 popup
+wg 1 1 1 porn
+wg 1 1 1 port
+wg 1 1 1 portal
+wg 1 1 1 portals
+wg 1 1 1 portfolio
+wg 1 1 1 pos
+wg 1 1 1 post
+wg 1 1 1 posted
+wg 1 1 1 postgres
+wg 1 1 1 postgresql
+wg 1 1 1 postnuke
+wg 1 1 1 postpaid
+wg 1 1 1 posts
+wg 1 1 1 pr
+wg 1 1 1 pr0n
+wg 1 1 1 premium
+wg 1 1 1 prepaid
+wg 1 1 1 presentation
+wg 1 1 1 presentations
+wg 1 1 1 preserve
+wg 1 1 1 press
+wg 1 1 1 preview
+wg 1 1 1 previews
+wg 1 1 1 previous
+wg 1 1 1 pricing
+wg 1 1 1 print
+wg 1 1 1 printenv
+wg 1 1 1 printer
+wg 1 1 1 printers
+wg 1 1 1 priv
+wg 1 1 1 privacy
+wg 1 1 1 private
+wg 1 1 1 pro
+wg 1 1 1 problems
+wg 1 1 1 proc
+wg 1 1 1 procedures
+wg 1 1 1 procure
+wg 1 1 1 procurement
+wg 1 1 1 prod
+wg 1 1 1 product
+wg 1 1 1 product_info
+wg 1 1 1 production
+wg 1 1 1 products
+wg 1 1 1 profile
+wg 1 1 1 profiles
+wg 1 1 1 profiling
+wg 1 1 1 program
+wg 1 1 1 programming
+wg 1 1 1 programs
+wg 1 1 1 progress
+wg 1 1 1 project
+wg 1 1 1 projects
+wg 1 1 1 promo
+wg 1 1 1 promoted
+wg 1 1 1 promotion
+wg 1 1 1 prop
+ws 1 1 1 prop-base
+wg 1 1 1 property
+wg 1 1 1 props
+wg 1 1 1 prot
+wg 1 1 1 protect
+wg 1 1 1 protected
+wg 1 1 1 protection
+wg 1 1 1 proto
+wg 1 1 1 proxies
+wg 1 1 1 proxy
+wg 1 1 1 prv
+wg 1 1 1 ps
+wg 1 1 1 psql
+wg 1 1 1 pt
+wg 1 1 1 pub
+wg 1 1 1 public
+wg 1 1 1 publication
+wg 1 1 1 publications
+wg 1 1 1 pubs
+wg 1 1 1 pull
+wg 1 1 1 purchase
+wg 1 1 1 purchases
+wg 1 1 1 purchasing
+wg 1 1 1 push
+wg 1 1 1 pw
+wg 1 1 1 pwd
+wg 1 1 1 python
+wg 1 1 1 q
+wg 1 1 1 q1
+wg 1 1 1 q2
+wg 1 1 1 q3
+wg 1 1 1 q4
+wg 1 1 1 qotd
+wg 1 1 1 qpid
+wg 1 1 1 quarterly
+wg 1 1 1 queries
+wg 1 1 1 query
+wg 1 1 1 queue
+wg 1 1 1 queues
+wg 1 1 1 quote
+wg 1 1 1 quotes
+wg 1 1 1 r
+wg 1 1 1 radio
+wg 1 1 1 random
+wg 1 1 1 rdf
+wg 1 1 1 read
+wg 1 1 1 readme
+wg 1 1 1 real
+wg 1 1 1 realestate
+wg 1 1 1 receive
+wg 1 1 1 received
+wg 1 1 1 recharge
+wg 1 1 1 record
+wg 1 1 1 recorded
+wg 1 1 1 recorder
+wg 1 1 1 records
+wg 1 1 1 recovery
+wg 1 1 1 recycle
+wg 1 1 1 recycled
+wg 1 1 1 redir
+wg 1 1 1 redirect
+wg 1 1 1 reference
+wg 1 1 1 reg
+wg 1 1 1 register
+wg 1 1 1 registered
+wg 1 1 1 registration
+wg 1 1 1 registrations
+wg 1 1 1 release
+wg 1 1 1 releases
+wg 1 1 1 remind
+wg 1 1 1 reminder
+wg 1 1 1 remote
+wg 1 1 1 removal
+wg 1 1 1 removals
+wg 1 1 1 remove
+wg 1 1 1 removed
+wg 1 1 1 render
+wg 1 1 1 rendered
+wg 1 1 1 rep
+wg 1 1 1 repl
+wg 1 1 1 replica
+wg 1 1 1 replicas
+wg 1 1 1 replicate
+wg 1 1 1 replicated
+wg 1 1 1 replication
+wg 1 1 1 replicator
+wg 1 1 1 reply
+wg 1 1 1 report
+wg 1 1 1 reporting
+wg 1 1 1 reports
+wg 1 1 1 reprints
+wg 1 1 1 req
+wg 1 1 1 reqs
+wg 1 1 1 request
+wg 1 1 1 requests
+wg 1 1 1 requisition
+wg 1 1 1 requisitions
+wg 1 1 1 res
+wg 1 1 1 research
+wg 1 1 1 resin
+wg 1 1 1 resize
+wg 1 1 1 resolution
+wg 1 1 1 resolve
+wg 1 1 1 resolved
+wg 1 1 1 resource
+wg 1 1 1 resources
+wg 1 1 1 rest
+wg 1 1 1 restore
+wg 1 1 1 restored
+wg 1 1 1 restricted
+wg 1 1 1 result
+wg 1 1 1 results
+wg 1 1 1 retail
+wg 1 1 1 reverse
+wg 1 1 1 reversed
+wg 1 1 1 revert
+wg 1 1 1 reverted
+wg 1 1 1 review
+wg 1 1 1 reviews
+wg 1 1 1 right
+wg 1 1 1 roam
+wg 1 1 1 roaming
+wg 1 1 1 robot
+wg 1 1 1 robots
+wg 1 1 1 roller
+wg 1 1 1 room
+wg 1 1 1 root
+wg 1 1 1 rpc
+wg 1 1 1 rsa
+wg 1 1 1 ru
+wg 1 1 1 ruby
+wg 1 1 1 rule
+wg 1 1 1 rules
+wg 1 1 1 run
+wg 1 1 1 rwservlet
+wg 1 1 1 s
+wg 1 1 1 sale
+wg 1 1 1 sales
+wg 1 1 1 salesforce
+wg 1 1 1 sam
+wg 1 1 1 samba
+wg 1 1 1 saml
+wg 1 1 1 sample
+wg 1 1 1 samples
+wg 1 1 1 san
+wg 1 1 1 sav
+wg 1 1 1 saved
+wg 1 1 1 saves
+wg 1 1 1 sbin
+wg 1 1 1 scan
+wg 1 1 1 scanned
+wg 1 1 1 scans
+wg 1 1 1 sched
+wg 1 1 1 schedule
+wg 1 1 1 scheduled
+wg 1 1 1 scheduling
+wg 1 1 1 schema
+wg 1 1 1 science
+wg 1 1 1 screen
+wg 1 1 1 screens
+wg 1 1 1 screenshot
+wg 1 1 1 screenshots
+wg 1 1 1 script
+wg 1 1 1 scriptlet
+wg 1 1 1 scriptlets
+wg 1 1 1 scripts
+wg 1 1 1 sdk
+wg 1 1 1 se
+wg 1 1 1 search
+wg 1 1 1 sec
+wg 1 1 1 second
+wg 1 1 1 secret
+wg 1 1 1 section
+wg 1 1 1 sections
+wg 1 1 1 secure
+wg 1 1 1 secured
+wg 1 1 1 security
+wg 1 1 1 seed
+wg 1 1 1 select
+wg 1 1 1 sell
+wg 1 1 1 send
+wg 1 1 1 sendmail
+wg 1 1 1 sendto
+wg 1 1 1 sent
+wg 1 1 1 serial
+wg 1 1 1 serv
+wg 1 1 1 serve
+wg 1 1 1 server
+ws 1 1 1 server-info
+ws 1 1 1 server-status
+wg 1 1 1 servers
+wg 1 1 1 service
+wg 1 1 1 services
+wg 1 1 1 servlet
+wg 1 1 1 servlets
+wg 1 1 1 session
+wg 1 1 1 sessions
+wg 1 1 1 setting
+wg 1 1 1 settings
+wg 1 1 1 setup
+wg 1 1 1 sex
+wg 1 1 1 shadow
+wg 1 1 1 share
+wg 1 1 1 shared
+wg 1 1 1 shares
+wg 1 1 1 shell
+wg 1 1 1 ship
+wg 1 1 1 shipped
+wg 1 1 1 shipping
+wg 1 1 1 shockwave
+wg 1 1 1 shop
+wg 1 1 1 shopper
+wg 1 1 1 shopping
+wg 1 1 1 shops
+wg 1 1 1 shoutbox
+wg 1 1 1 show
+wg 1 1 1 show_post
+wg 1 1 1 show_thread
+wg 1 1 1 showcat
+wg 1 1 1 showenv
+wg 1 1 1 showjobs
+wg 1 1 1 showmap
+wg 1 1 1 showmsg
+wg 1 1 1 showpost
+wg 1 1 1 showthread
+wg 1 1 1 sign
+wg 1 1 1 signed
+wg 1 1 1 signer
+wg 1 1 1 signin
+wg 1 1 1 signing
+wg 1 1 1 signoff
+wg 1 1 1 signon
+wg 1 1 1 signout
+wg 1 1 1 signup
+wg 1 1 1 simple
+wg 1 1 1 sink
+wg 1 1 1 site
+wg 1 1 1 site-map
+wg 1 1 1 site_map
+wg 1 1 1 sitemap
+wg 1 1 1 sites
+wg 1 1 1 skel
+wg 1 1 1 skin
+wg 1 1 1 skins
+wg 1 1 1 skip
+wg 1 1 1 sl
+wg 1 1 1 sling
+wg 1 1 1 sm
+wg 1 1 1 small
+wg 1 1 1 smile
+wg 1 1 1 smiles
+wg 1 1 1 sms
+wg 1 1 1 smtp
+wg 1 1 1 snoop
+wg 1 1 1 soap
+wg 1 1 1 soaprouter
+wg 1 1 1 soft
+wg 1 1 1 software
+wg 1 1 1 solaris
+wg 1 1 1 sold
+wg 1 1 1 solution
+wg 1 1 1 solutions
+wg 1 1 1 solve
+wg 1 1 1 solved
+wg 1 1 1 source
+wg 1 1 1 sources
+wg 1 1 1 sox
+wg 1 1 1 sp
+wg 1 1 1 space
+wg 1 1 1 spacer
+wg 1 1 1 spam
+wg 1 1 1 special
+wg 1 1 1 specials
+wg 1 1 1 sponsor
+wg 1 1 1 sponsors
+wg 1 1 1 spool
+wg 1 1 1 sport
+wg 1 1 1 sports
+wg 1 1 1 sqlnet
+wg 1 1 1 squirrel
+wg 1 1 1 squirrelmail
+wg 1 1 1 src
+wg 1 1 1 srv
+wg 1 1 1 ss
+wg 1 1 1 ssh
+wg 1 1 1 ssi
+wg 1 1 1 ssl
+ws 1 1 1 sslvpn
+wg 1 1 1 ssn
+wg 1 1 1 sso
+wg 1 1 1 staff
+wg 1 1 1 staging
+wg 1 1 1 standalone
+wg 1 1 1 standard
+wg 1 1 1 standards
+wg 1 1 1 star
+wg 1 1 1 start
+wg 1 1 1 stat
+wg 1 1 1 statement
+wg 1 1 1 statements
+wg 1 1 1 static
+wg 1 1 1 staticpages
+wg 1 1 1 statistic
+wg 1 1 1 statistics
+wg 1 1 1 stats
+wg 1 1 1 status
+wg 1 1 1 stock
+wg 1 1 1 storage
+wg 1 1 1 store
+wg 1 1 1 stored
+wg 1 1 1 stores
+wg 1 1 1 stories
+wg 1 1 1 story
+wg 1 1 1 strut
+wg 1 1 1 struts
+wg 1 1 1 student
+wg 1 1 1 students
+wg 1 1 1 stuff
+wg 1 1 1 style
+wg 1 1 1 styles
+wg 1 1 1 submissions
+wg 1 1 1 submit
+wg 1 1 1 subscribe
+wg 1 1 1 subscribed
+wg 1 1 1 subscriber
+wg 1 1 1 subscribers
+wg 1 1 1 subscription
+wg 1 1 1 subscriptions
+wg 1 1 1 success
+wg 1 1 1 suite
+wg 1 1 1 suites
+wg 1 1 1 sun
+wg 1 1 1 sunos
+wg 1 1 1 super
+wg 1 1 1 support
+wg 1 1 1 surf
+wg 1 1 1 survey
+wg 1 1 1 surveys
+wg 1 1 1 sws
+wg 1 1 1 synapse
+wg 1 1 1 sync
+wg 1 1 1 synced
+wg 1 1 1 sys
+wg 1 1 1 sysmanager
+wg 1 1 1 system
+wg 1 1 1 systems
+wg 1 1 1 sysuser
+wg 1 1 1 t
+wg 1 1 1 tag
+wg 1 1 1 tags
+wg 1 1 1 tail
+wg 1 1 1 tape
+wg 1 1 1 tapes
+wg 1 1 1 tapestry
+wg 1 1 1 tb
+wg 1 1 1 tcl
+wg 1 1 1 team
+wg 1 1 1 tech
+wg 1 1 1 technical
+wg 1 1 1 technology
+wg 1 1 1 tel
+wg 1 1 1 tele
+wg 1 1 1 templ
+wg 1 1 1 template
+wg 1 1 1 templates
+wg 1 1 1 terms
+ws 1 1 1 test-cgi
+ws 1 1 1 test-env
+wg 1 1 1 test1
+wg 1 1 1 test123
+wg 1 1 1 test1234
+wg 1 1 1 test2
+wg 1 1 1 test3
+wg 1 1 1 testimonial
+wg 1 1 1 testimonials
+wg 1 1 1 testing
+wg 1 1 1 tests
+wg 1 1 1 texis
+wg 1 1 1 text
+ws 1 1 1 text-base
+wg 1 1 1 texts
+wg 1 1 1 theme
+wg 1 1 1 themes
+wg 1 1 1 thread
+wg 1 1 1 threads
+wg 1 1 1 thumb
+wg 1 1 1 thumbnail
+wg 1 1 1 thumbnails
+wg 1 1 1 thumbs
+wg 1 1 1 tickets
+wg 1 1 1 tiki
+wg 1 1 1 tiles
+wg 1 1 1 tip
+wg 1 1 1 tips
+wg 1 1 1 title
+wg 1 1 1 tls
+wg 1 1 1 tmpl
+wg 1 1 1 tmps
+wg 1 1 1 tn
+wg 1 1 1 toc
+wg 1 1 1 todo
+wg 1 1 1 toggle
+wg 1 1 1 tomcat
+wg 1 1 1 tool
+wg 1 1 1 toolbar
+wg 1 1 1 toolkit
+wg 1 1 1 tools
+wg 1 1 1 top
+wg 1 1 1 topic
+wg 1 1 1 topics
+wg 1 1 1 torrent
+wg 1 1 1 torrents
+wg 1 1 1 tos
+wg 1 1 1 tour
+wg 1 1 1 tpv
+wg 1 1 1 tr
+wg 1 1 1 traceroute
+wg 1 1 1 traces
+wg 1 1 1 track
+wg 1 1 1 trackback
+wg 1 1 1 tracker
+wg 1 1 1 trackers
+wg 1 1 1 tracking
+wg 1 1 1 tracks
+wg 1 1 1 traffic
+wg 1 1 1 trailer
+wg 1 1 1 trailers
+wg 1 1 1 training
+wg 1 1 1 trans
+wg 1 1 1 transaction
+wg 1 1 1 transactions
+wg 1 1 1 transparent
+wg 1 1 1 transport
+wg 1 1 1 trash
+wg 1 1 1 travel
+wg 1 1 1 treasury
+wg 1 1 1 tree
+wg 1 1 1 trees
+wg 1 1 1 trial
+wg 1 1 1 true
+wg 1 1 1 trunk
+wg 1 1 1 tsweb
+wg 1 1 1 tt
+wg 1 1 1 turbine
+wg 1 1 1 tuscany
+wg 1 1 1 tutorial
+wg 1 1 1 tutorials
+wg 1 1 1 tv
+wg 1 1 1 tweak
+wg 1 1 1 twitter
+wg 1 1 1 type
+ws 1 1 1 typo3
+ws 1 1 1 typo3conf
+wg 1 1 1 u
+wg 1 1 1 ubb
+wg 1 1 1 uds
+wg 1 1 1 uk
+wg 1 1 1 umts
+wg 1 1 1 union
+wg 1 1 1 unix
+wg 1 1 1 unlock
+wg 1 1 1 unpaid
+wg 1 1 1 unreg
+wg 1 1 1 unregister
+wg 1 1 1 unsubscribe
+wg 1 1 1 up
+wg 1 1 1 upd
+wg 1 1 1 update
+wg 1 1 1 updated
+wg 1 1 1 updater
+wg 1 1 1 updates
+wg 1 1 1 upload
+wg 1 1 1 uploader
+wg 1 1 1 uploads
+wg 1 1 1 url
+wg 1 1 1 urls
+wg 1 1 1 us
+wg 1 1 1 usa
+wg 1 1 1 usage
+wg 1 1 1 user
+wg 1 1 1 userlog
+wg 1 1 1 users
+wg 1 1 1 usr
+wg 1 1 1 util
+wg 1 1 1 utilities
+wg 1 1 1 utility
+wg 1 1 1 utils
+wg 1 1 1 v
+wg 1 1 1 v1
+wg 1 1 1 v2
+wg 1 1 1 var
+wg 1 1 1 vault
+wg 1 1 1 vector
+wg 1 1 1 velocity
+wg 1 1 1 vendor
+wg 1 1 1 vendors
+wg 1 1 1 ver
+wg 1 1 1 ver1
+wg 1 1 1 ver2
+wg 1 1 1 version
+wg 1 1 1 vfs
+wg 1 1 1 video
+wg 1 1 1 videos
+wg 1 1 1 view
+wg 1 1 1 view-source
+wg 1 1 1 viewcvs
+wg 1 1 1 viewforum
+wg 1 1 1 viewonline
+wg 1 1 1 views
+wg 1 1 1 viewsource
+wg 1 1 1 viewsvn
+wg 1 1 1 viewtopic
+wg 1 1 1 viewvc
+wg 1 1 1 virtual
+wg 1 1 1 vm
+wg 1 1 1 voip
+wg 1 1 1 vol
+wg 1 1 1 vote
+wg 1 1 1 voter
+wg 1 1 1 votes
+wg 1 1 1 vpn
+wg 1 1 1 vuln
+wg 1 1 1 w
+wg 1 1 1 w3
+wg 1 1 1 w3c
+wg 1 1 1 wa
+wg 1 1 1 wap
+wg 1 1 1 warez
+ws 1 1 1 way-board
+wg 1 1 1 wbboard
+wg 1 1 1 wc
+wg 1 1 1 weather
+wg 1 1 1 web
+wg 1 1 1 web-beans
+wg 1 1 1 web-console
+wg 1 1 1 webaccess
+wg 1 1 1 webadmin
+wg 1 1 1 webagent
+wg 1 1 1 webalizer
+wg 1 1 1 webapp
+wg 1 1 1 webb
+wg 1 1 1 webbbs
+wg 1 1 1 webboard
+wg 1 1 1 webcalendar
+wg 1 1 1 webcart
+wg 1 1 1 webcasts
+wg 1 1 1 webcgi
+wg 1 1 1 webchat
+wg 1 1 1 webdata
+wg 1 1 1 webdav
+wg 1 1 1 webdb
+wg 1 1 1 weblog
+wg 1 1 1 weblogic
+wg 1 1 1 weblogs
+wg 1 1 1 webmail
+wg 1 1 1 webplus
+wg 1 1 1 webshop
+wg 1 1 1 website
+wg 1 1 1 websphere
+wg 1 1 1 websql
+wg 1 1 1 webstats
+wg 1 1 1 websvn
+wg 1 1 1 webwork
+wg 1 1 1 week
+wg 1 1 1 weekly
+wg 1 1 1 welcome
+wg 1 1 1 whitepapers
+wg 1 1 1 whois
+wg 1 1 1 whosonline
+wg 1 1 1 wicket
+wg 1 1 1 wiki
+wg 1 1 1 win
+ws 1 1 1 win32
+wg 1 1 1 windows
+ws 1 1 1 winnt
+wg 1 1 1 wireless
+wg 1 1 1 wml
+wg 1 1 1 word
+wg 1 1 1 wordpress
+wg 1 1 1 work
+wg 1 1 1 working
+wg 1 1 1 world
+wg 1 1 1 wow
+wg 1 1 1 wp
+wg 1 1 1 wp-content
+wg 1 1 1 wp-dbmanager
+wg 1 1 1 wp-includes
+wg 1 1 1 wp-login
+wg 1 1 1 wp-syntax
+wg 1 1 1 wrap
+ws 1 1 1 ws-client
+ws 1 1 1 ws_ftp
+wg 1 1 1 wsdl
+wg 1 1 1 wtai
+wg 1 1 1 www
+wg 1 1 1 www-sql
+wg 1 1 1 www1
+wg 1 1 1 www2
+wg 1 1 1 www3
+wg 1 1 1 wwwboard
+wg 1 1 1 wwwroot
+wg 1 1 1 wwwstats
+wg 1 1 1 wwwthreads
+wg 1 1 1 wwwuser
+wg 1 1 1 wysiwyg
+wg 1 1 1 x
+wg 1 1 1 xalan
+wg 1 1 1 xerces
+wg 1 1 1 xhtml
+wg 1 1 1 xmlrpc
+wg 1 1 1 xsql
+wg 1 1 1 xxx
+wg 1 1 1 xyzzy
+wg 1 1 1 y
+wg 1 1 1 yahoo
+wg 1 1 1 year
+wg 1 1 1 yearly
+wg 1 1 1 youtube
+wg 1 1 1 yt
+wg 1 1 1 z
+wg 1 1 1 zboard
+wg 1 1 1 zencart
+wg 1 1 1 zend
+wg 1 1 1 zero
+wg 1 1 1 zimbra
+wg 1 1 1 zipfiles
+wg 1 1 1 zips
+wg 1 1 1 zoom
+wg 1 1 1 zope
+wg 1 1 1 zorum
+ws 1 1 1 ~admin
+ws 1 1 1 ~amanda
+ws 1 1 1 ~apache
+ws 1 1 1 ~ashley
+ws 1 1 1 ~bin
+ws 1 1 1 ~bob
+ws 1 1 1 ~chris
+ws 1 1 1 ~dan
+ws 1 1 1 ~eric
+ws 1 1 1 ~ftp
+ws 1 1 1 ~guest
+ws 1 1 1 ~http
+ws 1 1 1 ~httpd
+ws 1 1 1 ~jacob
+ws 1 1 1 ~jennifer
+ws 1 1 1 ~jessica
+ws 1 1 1 ~john
+ws 1 1 1 ~log
+ws 1 1 1 ~logs
+ws 1 1 1 ~lp
+ws 1 1 1 ~mark
+ws 1 1 1 ~matt
+ws 1 1 1 ~michael
+ws 1 1 1 ~nobody
+ws 1 1 1 ~root
+ws 1 1 1 ~test
+ws 1 1 1 ~tmp
+ws 1 1 1 ~www
diff --git a/dictionaries/complete.wl b/dictionaries/complete.wl
index 8529719..6fa8534 100644
--- a/dictionaries/complete.wl
+++ b/dictionaries/complete.wl
@@ -1,3 +1,4 @@
+#ro
 e 1 1 1 7z
 e 1 1 1 as
 e 1 1 1 asmx
diff --git a/dictionaries/extensions-only.wl b/dictionaries/extensions-only.wl
index 732f894..45c183f 100644
--- a/dictionaries/extensions-only.wl
+++ b/dictionaries/extensions-only.wl
@@ -1,3 +1,4 @@
+#ro
 e 1 1 1 7z
 e 1 1 1 as
 e 1 1 1 asmx
diff --git a/dictionaries/medium.wl b/dictionaries/medium.wl
index e359a04..7ede330 100644
--- a/dictionaries/medium.wl
+++ b/dictionaries/medium.wl
@@ -1,3 +1,4 @@
+#ro
 e 1 1 1 asmx
 e 1 1 1 asp
 e 1 1 1 aspx
diff --git a/dictionaries/minimal.wl b/dictionaries/minimal.wl
index 546e6d6..90b5da4 100644
--- a/dictionaries/minimal.wl
+++ b/dictionaries/minimal.wl
@@ -1,3 +1,4 @@
+#ro
 e 1 1 1 bak
 e 1 1 1 cfg
 e 1 1 1 class
diff --git a/dictionaries/test.wl b/dictionaries/test.wl
new file mode 100644
index 0000000..a0dbc5f
--- /dev/null
+++ b/dictionaries/test.wl
@@ -0,0 +1,5 @@
+es 1 2 2 php
+ws 1 2 2 cgi-bin
+eg 1 2 2 old
+wg 1 2 2 admin
+w? 1 0 0 localhost
diff --git a/http_client.c b/http_client.c
index a79d964..9623fae 100644
--- a/http_client.c
+++ b/http_client.c
@@ -48,22 +48,26 @@
 
 /* Assorted exported settings: */
 
-u32 max_connections = MAX_CONNECTIONS,
-    max_conn_host   = MAX_CONN_HOST,
-    max_requests    = MAX_REQUESTS,
-    max_fail        = MAX_FAIL,
-    idle_tmout      = IDLE_TMOUT,
-    resp_tmout      = RESP_TMOUT,
-    rw_tmout        = RW_TMOUT,
-    size_limit      = SIZE_LIMIT;
+u32 max_connections  = MAX_CONNECTIONS,
+    max_conn_host    = MAX_CONN_HOST,
+    max_requests     = MAX_REQUESTS,
+    max_fail         = MAX_FAIL,
+    idle_tmout       = IDLE_TMOUT,
+    resp_tmout       = RESP_TMOUT,
+    rw_tmout         = RW_TMOUT,
+    size_limit       = SIZE_LIMIT;
 
-u8 browser_type     = BROWSER_FAST;
-u8 auth_type        = AUTH_NONE;
+u8 browser_type      = BROWSER_FAST;
+u8 auth_type         = AUTH_NONE;
+
+float max_requests_sec = MAX_REQUESTS_SEC;
 
 struct param_array global_http_par;
 
 /* Counters: */
 
+float req_sec;
+
 u32 req_errors_net,
     req_errors_http,
     req_errors_cur,
@@ -81,18 +85,21 @@ u32 req_errors_net,
 u64 bytes_sent,
     bytes_recv,
     bytes_deflated,
-    bytes_inflated;
+    bytes_inflated,
+    iterations_cnt = 0;
 
 u8 *auth_user,
    *auth_pass;
 
+
 #ifdef PROXY_SUPPORT
 u8* use_proxy;
 u32 use_proxy_addr;
 u16 use_proxy_port;
 #endif /* PROXY_SUPPORT */
 
-u8  ignore_cookies;
+u8  ignore_cookies,
+    idle;
 
 /* Internal globals for queue management: */
 
@@ -127,7 +134,6 @@ u8* get_value(u8 type, u8* name, u32 offset,
 
 }
 
-
 /* Inserts or overwrites parameter value in param_array. If offset
    == -1, will append parameter to list. Duplicates strings,
    name and val can be NULL. */
@@ -1483,6 +1489,7 @@ u8 parse_response(struct http_request* req, struct http_response* res,
     *val = 0;
     while (isspace(*(++val)));
 
+    SET_HDR(cur_line, val, &res->hdr);
     if (!strcasecmp((char*)cur_line, "Set-Cookie") ||
         !strcasecmp((char*)cur_line, "Set-Cookie2")) {
 
@@ -1516,6 +1523,7 @@ u8 parse_response(struct http_request* req, struct http_response* res,
              strncmp((char*)cval, (char*)orig_val, 3))) {
            res->cookies_set = 1;
            problem(PROB_NEW_COOKIE, req, res, val, req->pivot, 0);
+
          }
 
          /* Set cookie globally, but ignore obvious attempts to delete
@@ -1525,8 +1533,7 @@ u8 parse_response(struct http_request* req, struct http_response* res,
            SET_CK(val, cval, &global_http_par);
 
       }
-
-    } else SET_HDR(cur_line, val, &res->hdr);
+    }
 
     /* Content-Type is worth mining for MIME, charset data at this point. */
 
@@ -2289,9 +2296,22 @@ SSL_read_more:
     struct queue_entry *q = queue;
 
     while (q) {
-      struct queue_entry* next = q->next;
       u32 to_host = 0;
 
+      // enforce the max requests per seconds requirement
+      if (max_requests_sec && req_sec > max_requests_sec) {
+        u32 diff = req_sec - max_requests_sec;
+
+        DEBUG("req_sec=%f max=%f diff=%u\n", req_sec, max_requests_sec, diff);
+        if ((iterations_cnt++)%(diff + 1) != 0) {
+            idle = 1;
+            return queue_cur;
+        }
+      }
+      idle = 0;
+
+      struct queue_entry* next = q->next;
+
       if (!q->c) {
 
         struct conn_entry* c = conn;
@@ -2457,7 +2477,6 @@ struct http_response* res_copy(struct http_response* res) {
 
 }
 
-
 /* Dumps HTTP request data, for diagnostic purposes: */
 
 void dump_http_request(struct http_request* r) {
diff --git a/http_client.h b/http_client.h
index b429aeb..543833d 100644
--- a/http_client.h
+++ b/http_client.h
@@ -266,10 +266,13 @@ void set_value(u8 type, u8* name, u8* val, s32 offset, struct param_array* par);
 
 /* Simplified macros for value table access: */
 
-#define GET_HDR(_name, _p)       get_value(PARAM_HEADER, _name, 0, _p)
-#define SET_HDR(_name, _val, _p) set_value(PARAM_HEADER, _name, _val, -1, _p)
-#define GET_CK(_name, _p)        get_value(PARAM_COOKIE, _name, 0, _p)
-#define SET_CK(_name, _val, _p)  set_value(PARAM_COOKIE, _name, _val, 0, _p)
+#define GET_CK(_name, _p)         get_value(PARAM_COOKIE, _name, 0, _p)
+#define SET_CK(_name, _val, _p)   set_value(PARAM_COOKIE, _name, _val, 0, _p)
+#define GET_PAR(_name, _p)        get_value(PARAM_QUERY, _name, 0, _p)
+#define SET_PAR(_name, _val, _p)  set_value(PARAM_QUERY, _name, _val, -1, _p)
+#define GET_HDR(_name, _p)        get_value(PARAM_HEADER, _name, 0, _p)
+#define SET_HDR(_name, _val, _p)  set_value(PARAM_HEADER, _name, _val, -1, _p)
+#define GET_HDR_OFF(_name, _p, _o) get_value(PARAM_HEADER, _name, _o, _p)
 
 void tokenize_path(u8* str, struct http_request* req, u8 add_slash);
 
@@ -383,12 +386,17 @@ extern u32 max_connections,
            conn_failed,
            queue_cur;
 
+extern float req_sec,
+             max_requests_sec;
+
 extern u64 bytes_sent,
            bytes_recv,
            bytes_deflated,
-           bytes_inflated;
+           bytes_inflated,
+           iterations_cnt;
 
-extern u8  ignore_cookies;
+extern u8  ignore_cookies,
+           idle;
 
 /* Flags for browser type: */
 
diff --git a/report.c b/report.c
index 093c2ef..4b8e81a 100644
--- a/report.c
+++ b/report.c
@@ -421,7 +421,7 @@ static void save_req_res(struct http_request* req, struct http_response* res, u8
     ck_free(rd);
   }
 
-  if (res && res->state == STATE_OK) {
+  if (res && req && res->state == STATE_OK) {
     u32 i;
     f = fopen("response.dat", "w");
     if (!f) PFATAL("Cannot create 'response.dat'");
@@ -430,8 +430,6 @@ static void save_req_res(struct http_request* req, struct http_response* res, u8
     for (i=0;i<res->hdr.c;i++)
       if (res->hdr.t[i] == PARAM_HEADER)
         fprintf(f, "%s: %s\n", res->hdr.n[i], res->hdr.v[i]);
-      else
-        fprintf(f, "Set-Cookie: %s=%s\n", res->hdr.n[i], res->hdr.v[i]);
 
     fprintf(f, "\n");
     fwrite(res->payload, res->pay_len, 1, f);
diff --git a/skipfish.1 b/skipfish.1
index e047838..8a65779 100644
--- a/skipfish.1
+++ b/skipfish.1
@@ -4,7 +4,7 @@
 skipfish \- active web application security reconnaissance tool
 .SH SYNOPSIS
 .B skipfish
-.RI [ options ] " -o output-directory start-url [start-url2 ...]"
+.RI [ options ] " -W wordlist -o output-directory start-url [start-url2 ...]"
 .br
 .SH DESCRIPTION
 .PP
@@ -100,15 +100,15 @@ be quiet, do not display realtime scan statistics
 
 .SS Dictionary management options:
 .TP
+.B \-S wordlist
+load a specified read-only wordlist for brute-force tests
+.TP
 .B \-W wordlist
-load an alternative wordlist (skipfish.wl)
+load a specified read-write wordlist for any site-specific learned words. This option is required but the specified file can be empty, to store the newly learned words and alternatively, you can use -W- to discard new words.
 .TP
 .B \-L
 do not auto-learn new keywords for the site
 .TP
-.B \-V
-do not update wordlist based on scan results
-.TP
 .B \-Y
 do not fuzz extensions during most directory brute-force steps
 .TP
@@ -123,6 +123,9 @@ maximum number of keyword guesses to keep in the jar (default: 256)
 
 .SS Performance settings:
 .TP
+.B \-l max_req
+max requests per second (0 = unlimited)
+.TP
 .B \-g max_conn
 maximum simultaneous TCP connections, global (default: 50)
 .TP
@@ -147,11 +150,15 @@ response size limit (default: 200000 B)
 .B \-e
 do not keep binary responses for reporting
 
+.SS Performance settings:
 .TP
-.B \-h, \-\-help
-Show summary of options.
+.B \-k duration
+stop scanning after the given duration (format: h:m:s)
+
 .SH AUTHOR
-skipfish was written by Michal Zalewski <lcamtuf@google.com>.
+skipfish was written by Michal Zalewski <lcamtuf@google.com>,
+with contributions from Niels Heinen <heinenn@google.com>,
+Sebastian Roschke <s.roschke@googlemail.com>, and other parties.
 .PP
 This manual page was written by Thorsten Schifferdecker <tsd@debian.systs.org>,
 for the Debian project (and may be used by others).
diff --git a/skipfish.c b/skipfish.c
index 30cf589..f7e4787 100644
--- a/skipfish.c
+++ b/skipfish.c
@@ -68,7 +68,7 @@ static void resize_handler(int sig) {
 /* Usage info. */
 
 static void usage(char* argv0) {
-  SAY("Usage: %s [ options ... ] -o output_dir start_url [ start_url2 ... ]\n\n"
+  SAY("Usage: %s [ options ... ] -W wordlist -o output_dir start_url [ start_url2 ... ]\n\n"
 
       "Authentication and access options:\n\n"
 
@@ -110,9 +110,9 @@ static void usage(char* argv0) {
 
       "Dictionary management options:\n\n"
 
-      "  -W wordlist    - load an alternative wordlist (%s)\n"
+      "  -W wordlist    - use a specified read-write wordlist (required)\n"
+      "  -S wordlist    - load a supplemental read-only wordlist\n"
       "  -L             - do not auto-learn new keywords for the site\n"
-      "  -V             - do not update wordlist based on scan results\n"
       "  -Y             - do not fuzz extensions in directory brute-force\n"
       "  -R age         - purge words hit more than 'age' scans ago\n"
       "  -T name=val    - add new form auto-fill rule\n"
@@ -120,6 +120,7 @@ static void usage(char* argv0) {
 
       "Performance settings:\n\n"
 
+      "  -l max_req     - max requests per second (%f)\n"
       "  -g max_conn    - max simultaneous TCP connections, global (%u)\n"
       "  -m host_conn   - max simultaneous connections, per target IP (%u)\n"
       "  -f max_fail    - max number of consecutive HTTP errors (%u)\n"
@@ -129,10 +130,14 @@ static void usage(char* argv0) {
       "  -s s_limit     - response size limit (%u B)\n"
       "  -e             - do not keep binary responses for reporting\n\n"
 
+      "Safety settings:\n\n"
+
+      "  -k duration    - stop scanning after the given duration h:m:s\n\n"
+
       "Send comments and complaints to <lcamtuf@google.com>.\n", argv0,
-      max_depth, max_children, max_descendants, max_requests, DEF_WORDLIST,
-      MAX_GUESSES, max_connections, max_conn_host, max_fail, resp_tmout,
-      rw_tmout, idle_tmout, size_limit);
+      max_depth, max_children, max_descendants, max_requests,
+      MAX_GUESSES, max_requests_sec, max_connections, max_conn_host,
+      max_fail, resp_tmout, rw_tmout, idle_tmout, size_limit);
 
   exit(1);
 }
@@ -164,14 +169,14 @@ void splash_screen(void) {
 
       "More info: " cYEL "http://code.google.com/p/skipfish/wiki/KnownIssues\n\n" cBRI);
 
-  if (!no_fuzz_ext && (keyword_orig_cnt * extension_cnt) > 1000) {
+  if (!no_fuzz_ext && (keyword_orig_cnt * wg_extension_cnt) > 1000) {
 
     SAY(cLRD 
 
         "NOTE: The scanner is currently configured for directory brute-force attacks,\n"
         "and will make about " cBRI "%u" cLRD " requests per every fuzzable location. If this is\n"
         "not what you wanted, stop now and consult the documentation.\n\n",
-        keyword_orig_cnt * extension_cnt);
+        keyword_orig_cnt * wg_extension_cnt);
 
   }
 
@@ -237,9 +242,10 @@ static void read_urls(u8* fn) {
 int main(int argc, char** argv) {
   s32 opt;
   u32 loop_cnt = 0, purge_age = 0, seed;
-  u8  dont_save_words = 0, show_once = 0, be_quiet = 0, display_mode = 0,
-      has_fake = 0;
+  u8  show_once = 0, be_quiet = 0, display_mode = 0, has_fake = 0;
   u8 *wordlist = NULL, *output_dir = NULL;
+  u8* gtimeout_str = NULL;
+  u32 gtimeout = 0;
 
   struct termios term;
   struct timeval tv;
@@ -258,7 +264,8 @@ int main(int argc, char** argv) {
   SAY("skipfish version " VERSION " by <lcamtuf@google.com>\n");
 
   while ((opt = getopt(argc, argv,
-          "+A:F:C:H:b:Nd:c:x:r:p:I:X:D:POYQMZUEK:W:LVT:J:G:R:B:q:g:m:f:t:w:i:s:o:hue")) > 0)
+          "+A:B:C:D:EF:G:H:I:J:K:LMNOPQR:S:T:UW:X:YZ"
+          "b:c:d:ef:g:hi:k:l:m:o:p:q:r:s:t:uw:x:")) > 0)
 
     switch (opt) {
 
@@ -371,10 +378,6 @@ int main(int argc, char** argv) {
         no_parse = 1;
         break;
 
-      case 'V':
-        dont_save_words = 1;
-        break;
-
       case 'M':
         warn_mixed = 1;
         break;
@@ -421,12 +424,16 @@ int main(int argc, char** argv) {
         break;
 
       case 'W':
-        if (optarg[0] == '+') load_keywords((u8*)optarg + 1, 1, 0);
-        else {
-          if (wordlist)
-            FATAL("Only one -W parameter permitted (unless '+' used).");
-          wordlist = (u8*)optarg;
-        }
+        if (wordlist)
+          FATAL("Only one -W parameter permitted (use -S to load supplemental dictionaries).");
+
+        if (!strcmp(optarg, "-")) wordlist = (u8*)"/dev/null";
+        else wordlist = (u8*)optarg;
+
+        break;
+
+      case 'S':
+        load_keywords((u8*)optarg, 1, 0);
         break;
 
       case 'b':
@@ -456,6 +463,11 @@ int main(int argc, char** argv) {
         if (!max_requests) FATAL("Invalid value '%s'.", optarg);
         break;
 
+      case 'l':
+        max_requests_sec = atof(optarg);
+        if (!max_requests_sec) FATAL("Invalid value '%s'.", optarg);
+        break;
+
       case 'f':
         max_fail = atoi(optarg);
         if (!max_fail) FATAL("Invalid value '%s'.", optarg);
@@ -500,6 +512,11 @@ int main(int argc, char** argv) {
         delete_bin = 1;
         break;
 
+      case 'k':
+        if (gtimeout_str) FATAL("Multiple -k options not allowed.");
+        gtimeout_str = (u8*)optarg;
+        break;
+
       case 'Z':
         no_500_dir = 1;
         break;
@@ -531,7 +548,27 @@ int main(int argc, char** argv) {
   if (max_connections < max_conn_host)
     max_connections = max_conn_host;
 
-  if (!wordlist) wordlist = (u8*)DEF_WORDLIST;
+  /* Parse the timeout string - format h:m:s */
+  if (gtimeout_str) {
+    int i = 0;
+    int m[3] = { 1, 60, 3600 };
+
+    u8* tok = (u8*)strtok((char*)gtimeout_str, ":");
+
+    while(tok && i <= 2) {
+      gtimeout += atoi((char*)tok) * m[i];
+      tok = (u8*)strtok(NULL, ":");
+      i++;
+    }
+
+    if(!gtimeout)
+      FATAL("Wrong timeout format, please use h:m:s (hours, minutes, seconds)");
+    DEBUG("* Scan timeout is set to %d seconds\n", gtimeout);
+  }
+
+
+  if (!wordlist)
+    FATAL("Wordlist not specified (try -h for help; see dictionaries/README-FIRST).");
 
   load_keywords(wordlist, 0, purge_age);
 
@@ -587,7 +624,23 @@ int main(int argc, char** argv) {
 
     u8 keybuf[8];
 
-    if (be_quiet || ((loop_cnt++ % 100) && !show_once)) continue;
+    u64 end_time;
+    u64 run_time;
+    struct timeval tv_tmp;
+
+    gettimeofday(&tv_tmp, NULL);
+    end_time = tv_tmp.tv_sec * 1000LL + tv_tmp.tv_usec / 1000;
+
+    run_time = end_time - st_time;
+    if (gtimeout > 0 && run_time && run_time/1000 > gtimeout) {
+      DEBUG("* Stopping scan due to timeout\n");
+      stop_soon = 1;
+    }
+
+    req_sec = (req_count - queue_cur / 1.15) * 1000 / (run_time + 1);
+
+    if (be_quiet || ((loop_cnt++ % 100) && !show_once && idle == 0))
+      continue;
 
     if (clear_screen) {
       SAY("\x1b[H\x1b[2J");
@@ -629,7 +682,7 @@ int main(int argc, char** argv) {
   tcsetattr(0, TCSANOW, &term);
   fcntl(0, F_SETFL, O_SYNC);
 
-  if (!dont_save_words) save_keywords((u8*)wordlist);
+  save_keywords((u8*)wordlist);
 
   write_report(output_dir, en_time - st_time, seed);