seclists

No entries match these filters. Clear filters

1. 2026.2 Oct 27, 2026 · issue 123
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026.2 https://github.com/danielmiessler/SecLists.git
   # already have the repo? check out this version:
   $ git checkout 2026.2

   • New detection Claude files added to quickhits.txt
   • New detection LureScope observed SSH credentials wordlist
   • New detection Risk-classified SQLi payload list
   • New detection Template engine fuzzing wordlist
2. 2026.1 Mar 23, 2026 · release notes

   SecLists 2026.1 adds AI safety testing wordlists, updated subdomain lists, and new cloud/DevOps/camera discovery lists.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2026.1 https://github.com/danielmiessler/SecLists.git
   # already have the repo? check out this version:
   $ git checkout 2026.1

   • Adds 2025 most-used passwords wordlist for up-to-date credential attacks.
   • Adds AI ethical and safety boundary testing wordlists for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code./AI security assessments.
   • Updates top-1-million subdomains lists with fresh Cloudflare data.
   • Adds new technology-specific wordlists for Kubernetes, Docker, Elasticsearch, Grafana, GitLab, and Prometheus discovery.
   • Adds OpenWRT discovery wordlist for router/embedded device enumeration.

   +7 more show less

   • Adds RTSP camera discovery wordlist for IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure./camera reconnaissance.
   • Adds SOfensive LFI wordlist with OS-classified LFI lists.
   • Adds wordlist for Bludit CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. directory and file discovery.
   • Adds locale-codes and language-codes wordlists.
   • Adds Brazilian Portuguese common.txt and Brazilian names list for localized brute-forcing.
   • Adds Polish password wordlist for language-specific credential attacks.
   • Expands API fuzzing endpoints, GraphQL payloads, login bypass payloads, Swagger.txt, SAP NetWeaver, and Spring endpoints.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Country codes wordlists are now prefixed with regional_, which will break tooling or scripts referencing the old filenames.
   • !The Windows LFI wordlist has been renamed from adeadfed, which will break tooling or scripts referencing that filename.
   • !The GracefulSecurity LFI wordlist has been removed.
   • !The wordlist der-postillon.txt has been removed.
   • !rstp.txt has been moved from the fuzzing directory to Discovery/Web-Content/Service-Specific, which will break paths referencing its previous location.
3. 2025.3 Sep 19, 2025 · release notes

   SecLists 2025.3 adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server discovery, and YYYY-MM-DD date wordlists plus expanded default-password and LFI coverage.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2025.3 https://github.com/danielmiessler/SecLists.git
   # already have the repo? check out this version:
   $ git checkout 2025.3

   • New Active Directory wordlist for AD-specific enumeration and password attacks.
   • New Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) server discovery dictionary for enumerating AI/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. tool endpoints.
   • New YYYY-MM-DD date-format wordlists for fuzzing date-based parameters and paths.
   • Adds /etc/apache2/.htpasswd to LFI fuzzing lists for broader local file inclusion coverage.
   • Expands web-all-content-types.txt with all IANA MIME types for content-type fuzzing.

   +9 more show less

   • Adds MCP server entries to common.txt for broad discovery sweeps.
   • Adds IBM Power Systems default credential padmin:padmin and Quectel entries to default-passwords.csv / default-passwords.txt.
   • Adds common Spanish names and words for language-aware password and username enumeration.
   • Expands Swagger/OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. endpoint wordlist for API surface discovery.
   • Adds Spring Cloud Gateway prefix permutations to Java-Spring-Boot.txt for behind-gateway service discovery.
   • Adds new SAP payload to the SAP fuzzing wordlist.
   • Adds encryptionkeys directory to common_directories.txt for key-store discovery.
   • Expands OBEX common filenames wordlist for Bluetooth object-exchange enumeration.
   • Adds more permutations to common_directories.txt for broader directory brute-forcing.

   14 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !All DirBuster wordlists are renamed with the DirBuster-2007 prefix (e.g., dirbuster/directory-list-2.3-medium.txt is now DirBuster-2007/...); any tooling or scripts referencing the old paths will break.
4. 2025.2 Apr 25, 2025 · release notes

   SecLists 2025.2 adds two 10M+ subdomain fuzzing wordlists and expands credential, DNS, and content-type lists.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2025.2 https://github.com/danielmiessler/SecLists.git
   # already have the repo? check out this version:
   $ git checkout 2025.2

   • Adds two 10 million+ entry subdomain fuzzing/discovery wordlists: Discovery/DNS/FUZZSUBS_CYFARE_1.txt and Discovery/DNS/FUZZSUBS_CYFARE_2.txt.
   • Adds keyboard-walk password patterns to existing credential wordlists.
   • Adds Pipfile entries to common.txt for web-content discovery.
   • Adds image/jpg and application/x-httpd-php content types to web-all-content-types.txt.
   • Adds DNS subdomain entry take-survey to subdomain discovery lists.

   +2 more show less

   • Adds new SSH credential combo to ssh-betterdefaultpasslist.txt.
   • All words wordlists consolidated under the new Miscellaneous/Words/ directory.

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !All words wordlists have been moved into Miscellaneous/Words/ — any tooling or scripts referencing their previous paths will break.
   • !German-words.txt was renamed from german_misc.txt — references to the old filename will break.
   • !Dutch_passwordlist.txt moved into Common-Credentials/Language-Specific/ — references to the old path will break.
   • !French passwords wordlists moved into the Language-Specific directory — references to their old paths will break.
   • !darkweb2017* wordlists moved into the Common-Credentials directory and renamed — references to old paths or filenames will break.
   • !probable-v2* wordlists moved into the Common-Credentials directory and renamed — references to old paths or filenames will break.
   • !pwdb passwords wordlists moved into Common-Credentials and renamed — references to old paths or filenames will break.
   • !UserPassCombo-Jay.txt wordlist has been removed — any tooling referencing it will break.
5. 2025.1 Feb 22, 2025 · release notes

   SecLists 2025.1 adds new SPA filepath, IIS, password, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., and API wordlists plus expanded coverage across existing lists.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2025.1 https://github.com/danielmiessler/SecLists.git
   # already have the repo? check out this version:
   $ git checkout 2025.1

   • Adds filepaths wordlist for testing Single-page applications (SPAs).
   • Adds IIS default page and image files wordlist.
   • Adds 2024-197_most_used_passwords.txt (derived from 2024-200_most_used_passwords) to Common-Credentials.
   • Expands LLM data-leakage payload wordlist with more entries.
   • Adds missing words to API actions wordlists.

   +5 more show less

   • Adds more endpoints to common.txt, including daloradius.
   • Adds protobuf mimetypes to relevant wordlists.
   • Expands combined_subdomains.txt with more subdomain entries.
   • Greatly expands Amounts wordlists.
   • Updates spring-boot.txt to cover Spring Boot v2.1.7 endpoints.

   10 details in Everything