SecLists README

The project's README from github.com/danielmiessler/SecLists. As one markdown file: README.md.

Project logo

About SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to enable a security tester to pull this repository onto a new testing box and have access to every type of list that may be needed.

This project is maintained by Daniel Miessler, Jason Haddix, Ignacio Portal and g0tmi1k.


Repository details

Repo size

Approx cloning time


Install

Zip

wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecList.zip && unzip SecList.zip && rm -f SecList.zip

Git: No commit history (faster)

git clone --depth 1 https://github.com/danielmiessler/SecLists.git

Git: Complete

git clone https://github.com/danielmiessler/SecLists.git

Kali Linux (Tool Page)

apt -y install seclists

BlackArch (Tool Page)

sudo pacman -S seclists

Attribution

See CONTRIBUTORS.md


Contributing

See CONTRIBUTING.md


Similar Projects

Wordlist Tools

Also checkout the .bin directory in this repository. We have a number of wordlist generators and mutators there.


💜 Support This Project

Sponsor danielmiessler Sponsor ItsIgnacioPortal

We spend hundreds of hours a year on open source. If you'd like to help support this project, you can sponsor us here:
danielmiessler (founder)
ItsIgnacioPortal (current maintainer since 2021)


Licensing

This project is licensed under the MIT license.

NOTE: Downloading this repository is likely to cause a false-positive alarm by your anti-virus or anti-malware software, the filepath should be whitelisted. There is nothing in SecLists that can harm your computer as-is, however it's not recommended to store these files on a server or other important system due to the risk of local file include attacks.

SecLists (danielmiessler/SecLists)

Searching Database…

74.2K ·GitHub
这是什么?SecLists 是一个庞大的安全测试现成字典合集,包括用户名、密码、URL、敏感数据模式、模糊测试(fuzzing)载荷、Web Shell 等,全部集中在一个仓库中。
这是一个工具,还是只是一堆文件?它是一个静态的文本列表文件合集,而不是可执行的工具。你需要把仓库拉取到本地,然后在自己的工具(模糊测试器、密码破解工具、扫描器)中引用这些文件。
我该怎么把这些字典下载到自己的电脑上?可以将仓库下载为 Zip 压缩包,也可以用 git 克隆(浅克隆不含提交历史,速度更快;也可以完整克隆)。在 Kali Linux 和 BlackArch 上,它也已作为工具包预装。
使用这些字典需要安装什么特殊软件吗?不需要。这些字典都是普通文件,你只需要准备好要把它们喂给的工具(例如模糊测试器、密码破解工具或 Web 扫描器)即可。部分辅助脚本位于 .bin 目录中。
下载这个东西有什么安全隐患吗?杀毒软件可能会因为其中包含密码和攻击模式列表而误报。维护者还提醒不要把这些文件存放在生产服务器上,因为存在本地文件包含(LFI)风险。
这个合集是怎么组织的?它按列表类型划分:用户名、密码、URL/发现路径、敏感数据模式、模糊测试载荷、Web Shell 等,每一类各占一个目录。
有没有可以用来生成自定义字典的相关工具?README 中链接了用于构建和变异自定义字典的配套工具,如 Cook、Wl、CeWL 和 Genoveva;仓库的 .bin 文件夹中也有生成器和变异器。
这些字典会定期更新吗?会的。项目设有自动化的 CI 工作流,会定期更新字典(例如 API 端点、合并的目录和单词列表)以及 README 本身。
如果 SecLists 不符合我的需求,有没有类似的项目?README 列出了一些替代项目,例如 Assetnote Wordlists、fuzz.txt、FuzzDB、PayloadsAllTheThings、BiblePass 和 SamLists。
Size
3.6 GB
Stars
74.2K
Age
14y
Commits · 90 Days