hackPanion

Scaffolded from one-multi-repos:
automated submodule setup + GitHub Actions for keep-up-to-date modules.

This is my personal companion repo I take with me on new machines where I need to perform security testing. As long as I pull this, I know it will have all other repos updated.

I called it "companion" as with it it brings hackers' most underrated friends: wordlists, payloads, dictionaries and so on.

Being public this is limited to public repositories only. If you like me need to have all your secret and private weapones as well, you can just apply this concept like I have.

Say you have custom dictionaries, payloads, exploits all sitting on private repositories, just repackage it all together in a "final companion" so it will have:

• all your private "companions"
• the "public" companion (for me, HackPanion)

---

Changelog

Commit	Description	Files	Changes	Net
b98b91e	feat: unified commit hooks — README changelog	1	+24/−0	24
d3d9021	fix: replace --force-with-lease with plain push, bump checkout to v4	1	+2/−2	0
20f64ed	Auto-commit submodule changes in hackPanion	6	+6/−6	0
661d680	Auto-commit submodule changes in hackPanion	4	+4/−4	0
45bc94f	Auto-commit submodule changes in hackPanion	5	+5/−5	0
9c7d7c6	Auto-commit submodule changes in hackPanion	6	+6/−6	0
8f53624	Auto-commit submodule changes in hackPanion	5	+5/−5	0
5f0bb4f	chore: update submodule pointers	6	+6/−6	0
87be21f	Auto-commit submodule changes in hackPanion	4	+4/−4	0
1b89f0e	docs: update README for bounty-targets-data submodule swap	0	+0/−0	0
4a24bed	feat: replace public-bugbounty-programs with arkadiyt/bounty-targets-data	3	+5/−4	1
5353d65	fix: add public-bugbounty-programs to README submodule status table	0	+0/−0	0
f937a85	feat: add projectdiscovery/public-bugbounty-programs as sparse submodule	3	+5/−0	5
51f0de7	Auto-commit submodule changes in hackPanion	5	+5/−5	0
b2df32f	Auto-commit submodule changes in hackPanion	5	+5/−5	0

Auto-generated — last 15 commits.

Usage

Clone

git clone --recursive --depth 1 [email protected]:gosirys/hackPanion.git
cd hackPanion
git config core.hooksPath .config/hooks  # enable automatic sparse checkout
.config/scripts/apply-sparse-checkout.sh  # apply sparse checkout to selective-sync repos

Pull

git pull --recurse-submodules --depth=1

Sparse checkout is automatically restored after pull/merge via git hooks.

Selective sync

Some submodules only sync specific files/directories instead of the full repo (see .config/sparse-checkout-config). This is handled automatically by git hooks after clone/pull. To manually re-apply:

.config/scripts/apply-sparse-checkout.sh

To add a new selective-sync repo, edit .config/submodules.txt and run .config/scripts/init-submodules.sh.

---

Submodule Status

Auto-updated daily by GitHub Actions. Sorted by last updated (most recent first).

Repository	Path	Last Updated
trickest/wordlists	wordlists	2026-04-18
trickest/resolvers	resolvers	2026-04-18
swisskyrepo/PayloadsAllTheThings	PayloadsAllTheThings	2026-04-18
projectdiscovery/nuclei-templates	nuclei-templates	2026-04-18
danielmiessler/SecLists	SecLists	2026-04-18
arkadiyt/bounty-targets-data	bounty-targets-data	2026-04-18
0x727/FingerprintHub	fingerprint/FingerprintHub	2026-04-18
chainreactors/fingers	fingerprint/fingers	2026-04-16
projectdiscovery/cdncheck	fingerprint/cdncheck	2026-04-12
ayoubfathi/leaky-paths	leaky-paths	2026-04-03
random-robbie/bruteforce-lists	bruteforce-lists	2026-02-18
many-passwords/many-passwords	many-passwords	2024-09-06
TheKingOfDuck/fuzzDicts	fuzzDicts	2023-11-13
EdgeSecurityTeam/EHole	fingerprint/EHole	2023-06-14

---

Repositories included

Wordlists & Payloads

All repos below use selective sync to only keep data files (no images, docs, scripts, etc). See .config/sparse-checkout-config for exact patterns.

Repository	Synced	Description
swisskyrepo/PayloadsAllTheThings	txt, xml, xsl, php, html, py, json, yml, zip	Payloads and bypasses for web application security testing.
danielmiessler/SecLists	txt, csv	Comprehensive collection of wordlists for security assessments.
random-robbie/bruteforce-lists	full	Wordlists and data files tailored for brute-forcing various targets.
TheKingOfDuck/fuzzDicts	full	Ready-to-use dictionaries designed specifically for web application fuzzing.
ayoubfathi/leaky-paths	full	Known sensitive or misconfigured paths and endpoints for rapid content discovery.
many-passwords/many-passwords	csv	Default and common credential lists for IoT devices, admin panels, and embedded systems.
trickest/resolvers	txt	An exhaustive, validated list of reliable public DNS resolvers.
trickest/wordlists	txt	A curated collection of real-world wordlists for reconnaissance and brute-forcing.

Fingerprinting & Detection (selective sync)

Repository	Synced	Description
chainreactors/fingers	resources/*.json.gz, *.yaml	Pre-compiled fingerprint data (ehole, fingerprinthub, goby, wappalyzer, nmap, etc.)
0x727/FingerprintHub	web_fingerprint_v3.json	Web technology fingerprint definitions.
EdgeSecurityTeam/EHole	finger.json	Fingerprint rules for identifying web frameworks and CMS.
projectdiscovery/cdncheck	sources_data.json	CDN, WAF, and cloud provider IP ranges.

Vulnerability Templates (selective sync)

Repository	Synced	Description
projectdiscovery/nuclei-templates	yaml, json	Community-curated vulnerability templates for the Nuclei scanner.

Bug Bounty (selective sync)

Repository	Synced	Description
arkadiyt/bounty-targets-data	data/*.json	Per-platform bug bounty scope data with in/out-of-scope targets, asset types, wildcards, and reward info. Auto-updated every 30 min.