◆ Vulnerable targets & payloads

SecLists

MIT

Wordlists, fuzzing payloads and credential lists — standard input for testing scanners, WAFs and login protections.

source ↗ ★ 73,427 last push 2026-09-10

Summary

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to enable a security tester to pull this repository onto a new testing box and have access to every type of list that may be needed. This project is maintained by Daniel Miessler, Jason Haddix, Ignacio Portal and g0tmi1k.

from the project README

Formats: txt
License: MIT
Added: 2026-09-10

Get it

From the project’s own instructions where it documents any; otherwise a plain clone.

shell
```
$ git clone --depth 1 https://github.com/danielmiessler/SecLists.git
```
The README's no-history clone, much faster than the full one. Antivirus may flag the payload files; they're harmless as-is.
shell
```
$ apt -y install seclists
```
On Kali Linux, where it's packaged.

6,277 files 3.4 GB repository

.txt 6,058
.md 60
.php 34
.zip 25
(no ext) 15
.py 14
.sh 11
.yml 8

Use it with

Commands are curated, not yet run by us.

ffuf — Fuzz a test target's paths with one of the collection's wordlists.

sample.txt

$ ffuf -u http://127.0.0.1:3000/FUZZ -w ./SecLists/Discovery/Web-Content/common.txt

SecLists

Summary

Get it

Contents

Use it with

Related tools

seclists

ffuf