Guide · Open source
How to use SecLists: install, find lists and use them safely
Updated · written with AI from the project's own documentation and checked against our catalogue data
SecLists is a collection of text files, called lists, that security testers use during assessments. It gathers usernames, passwords, URLs, sensitive data patterns, fuzzing payloads and web shells in one repository. This guide shows how to get the lists onto a machine, what is inside, and how to use them with care.
SecListsdanielmiessler/SecLists · ★ 74.5k · MIT Install options & downloads Quick start
- 1Choose an install route. Pick git, zip, Kali Linux or BlackArch depending on your system. Git and wget with unzip are the prerequisites named in the README.
- 2Clone the repository. Run the shallow clone for a faster download without commit history, or the full clone if you want the history.
- 3Set aside a testing machine. Keep the files off servers and important systems, as the README advises.
- 4Browse the list categories. Open the folders and find the list type that matches your task.
- 5Check a list before use. Open the text file to confirm it contains what you expect.
- 6Point your tool at the file. Give your fuzzing or guessing tool the path to the wordlist. Check that tool's documentation for the exact option.
What SecLists contains and who it is for
SecLists is described as the security tester's companion. It is a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
It suits penetration testers who need standard lists for password or directory guessing, security students learning how assessments use wordlists, bug bounty hunters setting up a new testing machine, and anyone running fuzzing tools that read wordlist files.
Install SecLists with git, zip, Kali or BlackArch
You need Git for the git clone options, or wget and unzip for the zip option. The README lists these install routes.
A shallow clone skips commit history and is faster. A complete clone keeps the full history. The full repository is large: the README cites roughly 9 minutes to clone at 50 Mb/s.
- Shallow git clone: git clone --depth 1 https://github.com/danielmiessler/SecLists.git
- Full git clone with history: git clone https://github.com/danielmiessler/SecLists.git
- Zip download and unzip: wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecList.zip && unzip SecList.zip && rm -f SecList.zip
- Kali Linux: apt -y install seclists
- BlackArch: sudo pacman -S seclists
git clone --depth 1 https://github.com/danielmiessler/SecLists.gitFind the right list for your task
The repository is organised by list type. Pick the category that matches what you are testing, such as usernames, passwords, URLs or fuzzing payloads, and point your tool at the file inside it.
Lists are plain text, so you can open them in any editor to check what is in them before you use them.
- Usernames for login guessing
- Passwords for password guessing
- URLs and directory names for content discovery
- Fuzzing payloads for input testing
- Web shells, which are attack payloads and should be handled with care
Use a list with a fuzzing or guessing tool
SecLists is not a program. You run a separate tool, and that tool reads a wordlist file from disk. The source does not name specific tools, so check your tool's documentation for how it takes a wordlist path.
The repository also has a .bin directory with wordlist generators and mutators, and the README lists related wordlist tools such as Cook, CeWL and Genoveva.
Handle SecLists safely
The README notes that downloading the repository is likely to trigger a false-positive alarm from antivirus or anti-malware software, so the filepath may need to be whitelisted. It states that nothing in SecLists can harm your computer as-is.
It also warns that storing these files on a server or other important system carries a risk of local file include attacks. Keep the lists on a dedicated testing machine rather than on systems that matter.
What people use it for
- A penetration tester loads a password list into a login guessing run on an authorised target.
- A bug bounty hunter builds a fresh testing box with every list type in one clone.
- A student compares how username and directory lists differ in a practice lab.
- A tester runs a fuzzing tool with a payload list to see how an input field responds.
Frequently asked questions
Is SecLists free to use?
SecLists is licensed under the MIT license, as stated in the README. Read the LICENSE file in the repository for the full terms.
Is SecLists a tool I can run?
No. The README describes it as a collection of lists, not a program. You use it alongside tools that read wordlist files.
How do I install SecLists on Kali Linux?
The README gives the command apt -y install seclists. On BlackArch the command is sudo pacman -S seclists.
How big is the SecLists download?
The README says the full repository takes roughly 9 minutes to clone at 50 Mb/s. A shallow clone with --depth 1 skips history and is faster.
Why did my antivirus flag SecLists?
The README warns that downloading the repository is likely to cause a false-positive alarm. You can whitelist the filepath, and the README states nothing in SecLists can harm your computer as-is.
What are the alternatives to SecLists?
The README lists Assetnote Wordlists, fuzz.txt, FuzzDB, PayloadsAllTheThings, BiblePass and SamLists as similar projects. Choose based on the list types you need.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
SecLists suits penetration testers, students and bug bounty hunters who want many standard list types in one place. It is not a tool, and it is large, so people who need one small file or a runnable program should look elsewhere.
Install options & downloads