seclists

SecLists is a security tester's companion: a centralized collection of many types of lists used during security assessments. It includes usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many other list types. The goal is to let a security tester clone the repository onto a new testing machine and have access to every type of list that may be needed. The project is maintained by Daniel Miessler, Jason Haddix, Ignacio Portal, and g0tmi1k. ## Installation SecLists can be obtained in several ways: - As a ZIP archive downloaded with wget - As a shallow Git clone (no commit history, faster) - As a full Git clone with history - Via the Kali Linux package manager (`apt -y install seclists`) - Via BlackArch (`sudo pacman -S seclists`) The repository is large, so shallow cloning is recommended when history is not required. ## Contents and Use The lists are commonly used for penetration testing, fuzzing, web application security assessments, content discovery, password brute-forcing, and similar security tasks. The repository also includes a `.bin` directory with wordlist generators and mutators. ## Related Resources The README lists several similar projects, including Assetnote Wordlists, fuzz.txt, FuzzDB, PayloadsAllTheThings, BiblePass, and SamLists. It also mentions wordlist tools such as Cook, Wl, CeWL, and Genoveva. ## Contributing and Licensing Attribution and contribution guidelines are provided in CONTRIBUTORS.md and CONTRIBUTING.md. The project is licensed under the MIT license. ## Security Note The README notes that downloading the repository may trigger false-positive alarms from antivirus or anti-malware software, and recommends whitelisting the filepath. It also advises against storing these files on a server or other important system due to the risk of local file include attacks.