Github · GitHub Repository Radar
danielmiessler SecLists
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Stars
73,256
Forks
25,105
Watchers: 73,256
Language
License: MIT License
Repository Radar Score
66 / 100
Growth
- 7d
- +0
- 30d
- +0
- %
- 0.0%
Not enough metric snapshots yet to chart growth for this repository.
Score breakdown
- popularity 92
- growth 0
- activity 100
- freshness 100
- community 80
Need help integrating this stack?
Our team builds with modern open-source stacks. Tell us what you are shipping.
Get a quote →
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to enable a security tester to pull this repository onto a new testing box and have access to every type of list that may be needed.
This project is maintained by Daniel Miessler, Jason Haddix, Ignacio Portal and g0tmi1k.
Zip
wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecList.zip && unzip SecList.zip && rm -f SecList.zip
Git: No commit history (faster)
git clone --depth 1 https://github.com/danielmiessler/SecLists.git
Git: Complete
git clone https://github.com/danielmiessler/SecLists.git
Kali Linux (Tool Page)
apt -y install seclists
BlackArch (Tool Page)
sudo pacman -S seclists
See CONTRIBUTORS.md
See CONTRIBUTING.md
- Assetnote Wordlists: High quality wordlists for content and subdomain discovery which are automatically updated every month.
- fuzz.txt: Wordlists of "potentially dangerous" files.
- FuzzDB: Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
- PayloadsAllTheThings: A list of useful payloads and bypass for Web Application Security and Pentest/CTF
- BiblePass: Wordlists compiled from Bible verses
- SamLists: Data-driven wordlists containing HTTP parameter names, directory names and filenames.
- Cook: A wordlist framework. An overpowered wordlist generator, splitter, merger, finder and saver. Cook facilitates the creation of permutations and combinations with a variety of encodings and many more features.
- Wl: CLI utility for converting strings to a given casing style.
- CeWL: Custom Word List generator.
- Genoveva: From a word list, it generates up to 17,335,754 combinations per word, mixing lowercase, capitalized, uppercase, full and partial L33T (for each vowel and "s"), reverse, numbers from 1 to 4 digits, dates in mmddyyyy format from 1950 to 2030, date format mmddyy, symbols at the end, symbols between name and date...
Also checkout the .bin directory in this repository. We have a number of wordlist generators and mutators there.
We spend hundreds of hours a year on open source. If you'd like to help support this project, you can sponsor us here:
danielmiessler (founder)
ItsIgnacioPortal (current maintainer since 2021)
This project is licensed under the MIT license.
NOTE: Downloading this repository is likely to cause a false-positive alarm by your anti-virus or anti-malware software, the filepath should be whitelisted. There is nothing in SecLists that can harm your computer as-is, however it's not recommended to store these files on a server or other important system due to the risk of local file include attacks.
Repository Radar analysis
Deterministic insights derived from public metadata and our observations — not personal testing or reviews.
Why this repository is interesting
- High absolute popularity (73,256 stars) signals broad adoption.
- Maintained recently (last push 2 weeks ago).
Who should use it
- Developers working primarily with PHP
Potential use cases
- Reference or evaluate PHP open-source approaches in this domain
Strengths
- Recent repository activity
- README present in our index
- Declared license: MIT License
- Substantial fork count (25,105) suggests reuse and contribution interest
Limitations / considerations
- Insights are derived from public metadata and our observations — not a substitute for code review
What to watch
- Re-check last push, issues, and releases on GitHub before production adoption
Strong signals: Strong community interest · Active maintenance
Source: GitHub (public metadata) + Repository Radar analysis. We do not claim ownership of third-party repositories.