# SecLists — The Security Tester's Companion Wordlist Collection

> A comprehensive collection of usernames, passwords, URLs, fuzzing payloads, sensitive data patterns, and web shells organized for security assessments.

## Install

Save as a script file and run:

# SecLists — The Security Tester's Companion Wordlist Collection

## Quick Use
```bash
# Clone the full collection
git clone --depth 1 https://github.com/danielmiessler/SecLists.git

# Use with ffuf for directory brute-forcing
ffuf -w SecLists/Discovery/Web-Content/common.txt -u https://target.com/FUZZ

# Use with Hydra for password testing
hydra -L SecLists/Usernames/top-usernames-shortlist.txt -P SecLists/Passwords/Common-Credentials/10k-most-common.txt target.com ssh
```

## Introduction
SecLists is a curated collection of multiple types of wordlists used during authorized security assessments. It centralizes usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and more into a single organized repository, saving security professionals hours of list-gathering work.

## What SecLists Does
- Provides categorized wordlists for web content discovery, subdomain enumeration, and directory brute-forcing
- Includes password lists ranging from common credentials to leaked database compilations for authorized credential testing
- Offers fuzzing payloads for XSS, SQL injection, command injection, and other OWASP Top 10 vulnerability classes
- Contains username lists, default credentials, and sensitive file patterns for reconnaissance
- Supplies web shell samples and pattern-matching signatures for detection and defense

## Architecture Overview
SecLists is organized into top-level directories by category: Discovery (web content, DNS, SNMP), Fuzzing (various injection payloads), Passwords (leaked lists, default creds), Usernames, Pattern-Matching (sensitive data regexes), and Web-Shells. Each category contains sub-folders with descriptive filenames indicating the list purpose and size. The collection is plain text files designed to integrate with any security tool that accepts wordlist input.

## Self-Hosting & Configuration
- Clone the repository with `git clone --depth 1` to skip full history and save bandwidth
- Total size is approximately 1 GB uncompressed; use sparse checkout if you only need specific categories
- Install via package managers: `apt install seclists` on Kali/Parrot or `brew install seclists` on macOS
- No runtime dependencies required; lists are plain text compatible with any tool
- Update regularly with `git pull` as the community continuously contributes new lists

## Key Features
- Contains over 1,000 individual wordlists covering nearly every security testing scenario
- Community-maintained by security professionals including Daniel Miessler, Jason Haddix, and g0tmi1k
- Integrates directly with tools like ffuf, Gobuster, Hydra, Burp Suite, Nuclei, and feroxbuster
- Organized by OWASP testing methodology categories for systematic assessments
- MIT-licensed and freely available for both personal and commercial security work

## Comparison with Similar Tools
- **FuzzDB** — older fuzzing-focused collection with less active maintenance; SecLists covers broader categories
- **Assetnote Wordlists** — auto-generated from web crawls for specific targets; SecLists is manually curated and general-purpose
- **PayloadsAllTheThings** — focuses on exploit payloads with technique explanations; SecLists provides raw wordlists for tool consumption
- **OneListForAll** — a single combined list for simplicity; SecLists maintains granular categorization for targeted testing

## FAQ
**Q: How large is the full SecLists repository?**
A: Approximately 1 GB when cloned with full content. Using `--depth 1` reduces the download significantly by skipping git history.

**Q: Can I use SecLists for bug bounty programs?**
A: Yes, SecLists is widely used in authorized bug bounty testing. Always ensure you have explicit permission before testing any target.

**Q: How often is SecLists updated?**
A: The repository receives regular community contributions and maintainer updates, typically multiple times per month.

**Q: Which tools work best with SecLists?**
A: ffuf, Gobuster, feroxbuster, Hydra, Burp Suite Intruder, Nuclei, and wfuzz all accept SecLists wordlists as input.

## Sources
- https://github.com/danielmiessler/SecLists
- https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents

---
Source: https://tokrepo.com/en/workflows/asset-894f8e21
Author: Script Depot