Pitchfork takes one word list per position, and then iterates through them in sequence (thus all word lists need to be the same length; if the lists are of different lengths, then Pitchfork will stop upon reaching the end of the shortest list).

For example, assume one three-element word list containing one, two, and three, a second three-element word list containing alpha, beta, and gamma, and the body date foo=position1&bar=position2. Then if position1 and position2 are both defined as positions, Pitchfork will produce the following sequence of attempts:

  • foo=one&bar=alpha
  • foo=two&bar=beta
  • foo=three&bar=gamma

This is generally the approach that would be used in order to test against a potential list of username/password tuples.