owasp-amass/amass · error

bruteforce wordlist_file item is not a string

Error message

bruteforce wordlist_file item is not a string

What it means

In loadBruteForceSettings, after asserting "wordlists" is a list, each element is asserted to be a string path via `wordlistPathRaw.(string)`. The assertion failed because at least one list item is a number, bool, nested map, or list instead of a string. The library needs plain string paths to resolve and read each wordlist file.

Source

Thrown at config/brute.go:43

	if !ok {
		return fmt.Errorf("bruteforce enabled is not a bool")
	}

	c.BruteForcing = enabled
	if !c.BruteForcing {
		return nil
	}

	if wordlistPathRaw, ok := bruteforce["wordlists"]; ok {
		wordlistPaths, ok := wordlistPathRaw.([]interface{})
		if !ok {
			return fmt.Errorf("bruteforce wordlist_file is not an array")
		}

		for _, wordlistPathRaw := range wordlistPaths {
			wordlistPath, ok := wordlistPathRaw.(string)
			if !ok {
				return fmt.Errorf("bruteforce wordlist_file item is not a string")
			}

			absPath, err := c.AbsPathFromConfigDir(wordlistPath)
			if err != nil {
				return fmt.Errorf("failed to get absolute path for wordlist file: %w", err)
			}

			wordlist, err := GetListFromFile(absPath)
			if err != nil {
				return fmt.Errorf("unable to load the file in the bruteforce wordlist_file setting: %s: %v", absPath, err)
			}

			c.Wordlist = append(c.Wordlist, wordlist...)
		}
	}

	c.Wordlist = stringset.Deduplicate(c.Wordlist)
	return nil

View on GitHub (pinned to 79299dce87)

Solutions

1. Quote every wordlist path in the list: wordlists:\n - "/path/to/list.txt"
2. Inspect the list and remove or fix any non-string entries
3. Check for paths that YAML auto-converts (numbers, booleans, glob chars) and quote them
4. Add a pre-parse check that every element of the array is a string

Example fix

# before
bruteforce:
  wordlists:
    - 42

# after
bruteforce:
  wordlists:
    - "/usr/share/words.txt"

func validateWordlistItems(wordlists []interface{}) error {
	for i, e := range wordlists {
		if _, ok := e.(string); !ok {
			return fmt.Errorf("wordlists[%d] must be a quoted string path, got %T", i, e)
		}
	}
	return nil
}

func isString(v interface{}) bool { _, ok := v.(string); return ok }

if err := cfg.LoadSettings(); err != nil {
	if strings.Contains(err.Error(), "wordlist_file item is not a string") {
		// quote every path entry in the config and reload
	}
	log.Fatal(err)
}

When it happens

Trigger: A bruteforce.wordlists array containing a non-string element, e.g. wordlists:\n - 42, an unquoted path that YAML parses as something else, or a nested mapping/list entry.

Common situations: Unquoted paths starting with special characters (e.g. * or yes/no) that YAML coerces to other types; a copy-paste error leaving an object where a path belongs; comment or indentation artifacts producing nested blocks.

Related errors

• failed to parse active setting, value is not a boolean
• bruteforce is not a map[string]interface{}
• bruteforce enabled is not a bool
• bruteforce wordlist_file is not an array
• alterations is not a map[string]interface{}

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/3d9aa86bd047de5c. Report an issue: GitHub.