SecLists: How to Pick the Right Wordlist (2026 Guide)

What Is SecLists?

SecLists is a free collection of wordlists used during security assessments: usernames, passwords, URL paths, subdomains, fuzzing payloads, web shells and pattern-matching rules, all gathered into one repository. It is maintained by Daniel Miessler and contributors at github.com/danielmiessler/SecLists, licensed MIT, and has passed 73,000 GitHub stars.

It is not a tool. Nothing in SecLists runs. It is input, and it is the input for almost every tool a beginner touches in their first month: gobuster, ffuf, dirsearch, Hydra, Hashcat, John the Ripper, sqlmap, wfuzz, Nuclei, Burp Intruder. The tool is the engine. The wordlist is the fuel, and the fuel decides where you end up.

That distinction matters more than it sounds. People spend weeks learning flags for a fuzzer and zero minutes learning which of the 20-odd web content lists they should have pointed it at. In practice the flags rarely decide the outcome. The list does.

How to Install SecLists

On Kali Linux, one command:

sudo apt install seclists

That installs version 2025.3 into /usr/share/seclists, about 1.8 GB on disk according to Kali's package page. Kali's wordlists package also drops a symlink at /usr/share/wordlists/seclists pointing to the same place, which is why you see both paths in guides. They are the same files. Use whichever you can type faster.

Everywhere else, clone it. Skip the commit history unless you enjoy waiting:

git clone --depth 1 https://github.com/danielmiessler/SecLists.git

BlackArch users get sudo pacman -S seclists. On macOS or a plain Ubuntu box the shallow clone is the sane route. There is also a zip download documented in the README, which is worth knowing about when you are on a host where git is not installed and you cannot install it.

One honest warning about the disk footprint. A shallow clone still pulls a couple of gigabytes, and a full clone with history pulls several more. On a cloud VPS with a 20 GB disk that is a real decision. If you only need web content lists, you can grab single files with wget from raw.githubusercontent.com and keep the whole thing under a megabyte.

What Is Inside SecLists

Nine top-level folders, and you will genuinely use four of them. Here is the map.

• Discovery - the folder you open most days. Subfolders for Web-Content (paths, files, extensions), DNS (subdomains), Infrastructure, File-System, SNMP, Variables and Mainframe.
• Passwords - leaked database dumps, default vendor credentials, common-credential lists ranked by frequency, and language-specific sets.
• Usernames - shortlists for spraying, the 8.2-million-entry xato username dump, plus real first-name and surname lists under Names.
• Fuzzing - the payload folder. SQL injection strings, XSS vectors, LFI traversal chains, format strings, template engine probes, Unicode edge cases and the famous big-list-of-naughty-strings.txt.
• Payloads, Web-Shells, Pattern-Matching, Miscellaneous and Ai/LLM_Testing - specialist material. The last one is newer and covers prompt injection and jailbreak strings for testing LLM-backed applications.

The folder names are descriptive and the file names are not always. That is the whole problem, and the next two sections are the answer to it.

How to Choose the Right Wordlist

Two questions decide it every time. What are you enumerating, and how long are you willing to wait?

The second question is the one beginners skip. A 220,000-entry list against a slow application with a 300 ms response time and 20 threads takes roughly 55 minutes. The 4,751-entry list takes about a minute and finds the same admin panel 90% of the time, because the admin panel is called /admin. Run the small list first, always. Escalate only when it comes back empty.

Notice the shape of that table. Online guessing against a live service uses tiny lists, because every attempt costs a round trip and risks a lockout. Offline cracking against a hash you already have uses enormous ones, because attempts are free. Mixing those two up is the single most common wordlist error, and it is why someone somewhere is currently pointing all 14 million rockyou entries at a login form with a five-attempt lockout policy.

The SecLists Files Worth Knowing by Name

Web content

common.txt is your default. 4,751 entries, covers the paths that exist on a large share of real web servers, finishes fast enough that you can run it while you read the homepage. When it returns nothing, move to raft-medium-directories.txt (29,999) or raft-large-directories.txt (62,281). The raft lists were generated from real-world crawls, which makes them better ordered than the alphabetical relics they replaced.

quickhits.txt (2,570) deserves special mention because it is not a directory list at all. It is a list of things that should never be public: .git/config, .env, .htpasswd, editor swap files, database backups. Two thousand requests, and on a badly deployed application one of them hands you credentials. Run it on every web target you are authorized to touch.

Then there is DirBuster-2007_directory-list-2.3-medium.txt, 220,559 lines, the one every old tutorial names. It is from 2007. The copyright header says so. It still works, but it is slow and its ordering reflects a web that no longer exists, so treat it as the pass you run overnight rather than the one you open with. Practice the full workflow in our ffuf fuzzing guide or the gobuster walkthrough.

Subdomains

The subdomains-top1million family comes in 5,000, 20,000 and 110,000 entry versions, plus a compressed full set. Start at 5,000. The gap between 5,000 and 110,000 is mostly noise for a single target, and DNS brute-forcing at that scale starts to look like abuse to the resolver you are hammering. n0kovo_subdomains.txt and bitquark-subdomains-top100000.txt are the two alternatives worth trying when the standard list runs dry.

Usernames and passwords

The two shortlists are the hidden gems of the whole repository. top-usernames-shortlist.txt has 17 entries and they are the right 17: root, admin, test, guest, mysql, oracle, pi, vagrant, ec2-user, azureuser and a handful more. top-passwords-shortlist.txt has 25. Seventeen times twenty-five is 425 attempts, which finishes in under a minute against SSH and is the correct first move on any box where you have no other lead.

Passwords/Default-Credentials/default-passwords.csv is 2,876 rows of vendor defaults indexed by product. When your scan turns up a router admin page or a printer web interface, that file answers the question faster than a search engine will. For offline work, rockyou.txt.tar.gz ships inside SecLists and needs extracting before use, which our rockyou.txt guide covers along with what is actually in those 14 million lines.

Fuzzing payloads

The Fuzzing folder is where SecLists stops being about discovery and starts being about breaking things. LFI/LFI-Jhaddix.txt (930 entries) is a ready-made traversal payload set. template-engines-identification.txt tells you which template engine you are looking at before you try to exploit it. big-list-of-naughty-strings.txt is the one to feed any input field when you want to know how badly the application handles edge cases. Load them into Burp Intruder or as the wordlist for a fuzzer and you have replaced an hour of manual payload typing.

Four SecLists Mistakes That Waste Your Afternoon

1. Using a file name from an old tutorial

SecLists renamed a lot of files to credit their sources, and the classics moved. directory-list-2.3-medium.txt is now DirBuster-2007_directory-list-2.3-medium.txt. 10-million-password-list-top-1000.txt is now xato-net-10-million-passwords-1000.txt. Every guide written before the rename points at a path that no longer resolves, and "file not found" reads to a beginner like a broken install. When a path fails, do not reinstall. Search:

ls /usr/share/seclists/Discovery/Web-Content/ | grep -i directory-list
find /usr/share/seclists -iname '*subdomain*'

2. Sending the comment lines as requests

The DirBuster lists open with a 13-line copyright header, every line starting with #. Most fuzzers do not know that and will dutifully request /# Copyright 2007 James Fisher and twelve equally pointless siblings. It rarely breaks anything, but it does dirty your output and it makes you look careless in a log review. ffuf has a flag for it:

ffuf -ic -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -u https://target.example/FUZZ

The portable fix, for tools that have no such flag, is to strip them yourself:

grep -v '^#' original.txt | grep -v '^$' > clean.txt

3. Forgetting extensions

The web content lists contain bare words. admin, not admin.php. If the application serves .php or .aspx files and you do not tell your tool to append extensions, you will miss every file and find only directories. In ffuf that is -e .php,.bak,.txt; gobuster uses -x. Discovery/Web-Content/web-extensions.txt holds a curated 43-entry set when you want to fuzz the extension itself instead of guessing.

4. Reaching for rockyou.txt by reflex

rockyou.txt came out of a 2009 breach of a social gaming site. It is excellent for cracking hashes offline and genuinely bad for almost everything else. Against a live login form it is too slow and too loud. Against a corporate target it is the wrong population entirely, because nobody at a company with a password policy is using iloveyou. The right list for a corporate target is one you built from the target itself, which is the next section.

When SecLists Is the Wrong Answer

Here is the part most guides will not tell you: on a real engagement, the best wordlist is usually one that does not exist yet.

SecLists is a collection of what was common across everybody. Your target is one organization with its own vocabulary: product code names, office locations, the founder's dog, an internal tool called something nobody outside the building has heard of. None of that is in a generic list, and all of it is in their own website.

So scrape it. cewl https://acme.example -d 2 -m 6 -w custom.txt crawls two levels deep and writes every word of six characters or more into a list. Feed that to Hashcat with a rules file and you get the mutations people actually pick: Acme2026!, acme123, Acme@Corp. On real engagements, target-derived lists find credentials that rockyou never will, and they do it in a fraction of the attempts.

The same logic applies to paths. Scrape the site, extract every URL fragment, and feed that back as a wordlist alongside common.txt. Naming conventions repeat: if you find /api/v1/users, then /api/v1/admin is worth a guess that no generic list will make for you. Building that list from a live target is the skill our Custom Wordlist Attack lab drills directly, and it transfers to every engagement you will ever run.

SecLists is still where you start. It is just not where you should stop.

Legal and Ethical Considerations

• Run wordlist attacks only against your own systems, deliberately vulnerable labs, or hosts explicitly named in a signed scope document.
• Password spraying can lock out real accounts. Know the lockout policy before you start, keep attempts well under the threshold, and agree the window with the client.
• Large wordlists generate large amounts of traffic. A 220,000-entry run at high thread counts is indistinguishable from a denial-of-service attempt from the defender's side, and it can genuinely take a small application down.
• Leaked password lists contain real credentials belonging to real people. Use them to test authorized systems, never to access accounts, and do not redistribute them outside that purpose.
• Write your wordlist choices into the report. "We tested against the 5,000 most common subdomains" is a scope statement a client can act on. "We ran a wordlist" is not.
• Follow an established methodology rather than improvising. The OWASP Web Security Testing Guide covers where enumeration belongs in a structured test.