SecLists: wordlists for authorised security testing

SecLists (about 74,000 stars on GitHub) is the most widely used collection of wordlists in the security profession. It was started in 2012 by Daniel Miessler and is co-maintained by Jason Haddix, Ignacio Pérez (g0tmi1k) and a community of contributors. The repository is organised into directories by purpose: usernames, passwords, discovery lists for web content and DNS names, fuzzing inputs, pattern-matching lists, payloads for authorised testing, and miscellaneous data such as common file extensions and wordlists in many languages. Several lists are large, so a full clone takes well over a gigabyte.

Who it is for

• Penetration testers and red teams working under a signed engagement, who need standard inputs for discovery and password-strength checks.
• Defenders and administrators who want to check their own systems: for example, testing whether a new password policy still allows the most common passwords, or confirming that an internal web server does not expose well-known admin paths.
• Developers writing input validation, who can run the fuzzing lists against their own application in a test environment.
• Students in training labs and CTF players, where these lists are the expected tooling.

How to install it

Kali Linux, Parrot and BlackArch package it as seclists, which puts the lists under /usr/share/seclists/. On any other system a shallow clone or a release archive is enough; use --depth 1 to avoid downloading the full history:

sudo apt install seclists                          # Kali / Parrot
git clone --depth 1 https://github.com/danielmiessler/SecLists.git   # anywhere else
ls SecLists/

The README explains the directory layout and lists the sources each wordlist was compiled from. Changes arrive through pull requests, and the maintainers publish tagged releases a few times a year for people who prefer a stable snapshot to a moving checkout.

Credit

SecLists is maintained by Daniel Miessler, Jason Haddix, Ignacio Pérez and the contributors credited in the repository. It is published under the MIT license.

Use it responsibly

Material of this kind is meant for systems you own or have written permission to test, for bug bounty programmes within their published scope, and for training labs and capture-the-flag (CTF) exercises. Unauthorised testing of other people’s systems is illegal in most countries, regardless of intent, and the maintainers of these projects say so in their own terms. Defenders can use the same material to check their own environments and to understand what their detection rules should catch.