https://cybertoolchain.io/tools/seclists New releases and features in seclists, tracked by The Cyber Toolchain. en Tue, 27 Oct 2026 08:06:41 GMT https://github.com/danielmiessler/SecLists/releases/tag/2026.2 https://github.com/danielmiessler/SecLists/releases/tag/2026.2 Tue, 27 Oct 2026 08:06:41 GMT SecLists 2026.2 adds SSH credential, SQLi payload, template engine fuzzing, and Claude-path wordlists.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Claude-related paths to `quickhits.txt` for discovery fuzzing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds LureScope-observed SSH credential list for credential-stuffing and brute-force testing. • Adds a risk-classified SQLi payload list for structured injection testing. • Adds a template engine fuzzing wordlist for SSTI discovery. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/seclists https://github.com/danielmiessler/SecLists/releases/tag/2026.1 https://github.com/danielmiessler/SecLists/releases/tag/2026.1 Mon, 23 Mar 2026 06:16:08 GMT SecLists 2026.1 adds AI safety testing wordlists, updated subdomain lists, and new cloud/DevOps/camera discovery lists. • Adds 2025 most-used passwords wordlist for up-to-date credential attacks. • Adds AI ethical and safety boundary testing wordlists for LLM/AI security assessments. • Updates top-1-million subdomains lists with fresh Cloudflare data. • Adds new technology-specific wordlists for Kubernetes, Docker, Elasticsearch, Grafana, GitLab, and Prometheus discovery. • Adds OpenWRT discovery wordlist for router/embedded device enumeration. • Adds RTSP camera discovery wordlist for IoT/camera reconnaissance. • Adds SOfensive LFI wordlist with OS-classified LFI lists. • Adds wordlist for Bludit CMS directory and file discovery. • Adds locale-codes and language-codes wordlists. • Adds Brazilian Portuguese common.txt and Brazilian names list for localized brute-forcing. • Adds Polish password wordlist for language-specific credential attacks. • Expands API fuzzing endpoints, GraphQL payloads, login bypass payloads, Swagger.txt, SAP NetWeaver, and Spring endpoints. Breaking changes: • Country codes wordlists are now prefixed with 'regional_', which will break tooling or scripts referencing the old filenames. • The Windows LFI wordlist has been renamed from 'adeadfed', which will break tooling or scripts referencing that filename. • The GracefulSecurity LFI wordlist has been removed. • The wordlist 'der-postillon.txt' has been removed. • 'rstp.txt' has been moved from the fuzzing directory to Discovery/Web-Content/Service-Specific, which will break paths referencing its previous location. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/seclists https://github.com/danielmiessler/SecLists/releases/tag/2025.3 https://github.com/danielmiessler/SecLists/releases/tag/2025.3 Fri, 19 Sep 2025 05:50:22 GMT SecLists 2025.3 adds Active Directory, MCP server discovery, and YYYY-MM-DD date wordlists plus expanded default-password and LFI coverage. • New Active Directory wordlist for AD-specific enumeration and password attacks. • New Model Context Protocol (MCP) server discovery dictionary for enumerating AI/LLM tool endpoints. • New YYYY-MM-DD date-format wordlists for fuzzing date-based parameters and paths. • Adds /etc/apache2/.htpasswd to LFI fuzzing lists for broader local file inclusion coverage. • Expands `web-all-content-types.txt` with all IANA MIME types for content-type fuzzing. • Adds MCP server entries to `common.txt` for broad discovery sweeps. • Adds IBM Power Systems default credential `padmin:padmin` and Quectel entries to `default-passwords.csv` / `default-passwords.txt`. • Adds common Spanish names and words for language-aware password and username enumeration. • Expands Swagger/OpenAPI endpoint wordlist for API surface discovery. • Adds Spring Cloud Gateway prefix permutations to `Java-Spring-Boot.txt` for behind-gateway service discovery. • Adds new SAP payload to the SAP fuzzing wordlist. • Adds `encryptionkeys` directory to `common_directories.txt` for key-store discovery. • Expands OBEX common filenames wordlist for Bluetooth object-exchange enumeration. • Adds more permutations to `common_directories.txt` for broader directory brute-forcing. Breaking changes: • All DirBuster wordlists are renamed with the `DirBuster-2007` prefix (e.g., `dirbuster/directory-list-2.3-medium.txt` is now `DirBuster-2007/...`); any tooling or scripts referencing the old paths will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/seclists https://github.com/danielmiessler/SecLists/releases/tag/2025.2 https://github.com/danielmiessler/SecLists/releases/tag/2025.2 Fri, 25 Apr 2025 23:57:31 GMT SecLists 2025.2 adds two 10M+ subdomain fuzzing wordlists and expands credential, DNS, and content-type lists. • Adds two 10 million+ entry subdomain fuzzing/discovery wordlists: `Discovery/DNS/FUZZSUBS_CYFARE_1.txt` and `Discovery/DNS/FUZZSUBS_CYFARE_2.txt`. • Adds keyboard-walk password patterns to existing credential wordlists. • Adds `Pipfile` entries to `common.txt` for web-content discovery. • Adds `image/jpg` and `application/x-httpd-php` content types to `web-all-content-types.txt`. • Adds DNS subdomain entry `take-survey` to subdomain discovery lists. • Adds new SSH credential combo to `ssh-betterdefaultpasslist.txt`. • All words wordlists consolidated under the new `Miscellaneous/Words/` directory. Breaking changes: • All words wordlists have been moved into `Miscellaneous/Words/` — any tooling or scripts referencing their previous paths will break. • `German-words.txt` was renamed from `german_misc.txt` — references to the old filename will break. • `Dutch_passwordlist.txt` moved into `Common-Credentials/Language-Specific/` — references to the old path will break. • French passwords wordlists moved into the `Language-Specific` directory — references to their old paths will break. • `darkweb2017*` wordlists moved into the `Common-Credentials` directory and renamed — references to old paths or filenames will break. • `probable-v2*` wordlists moved into the `Common-Credentials` directory and renamed — references to old paths or filenames will break. • `pwdb` passwords wordlists moved into `Common-Credentials` and renamed — references to old paths or filenames will break. • `UserPassCombo-Jay.txt` wordlist has been removed — any tooling referencing it will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/seclists https://github.com/danielmiessler/SecLists/releases/tag/2025.1 https://github.com/danielmiessler/SecLists/releases/tag/2025.1 Sat, 22 Feb 2025 09:24:01 GMT SecLists 2025.1 adds new SPA filepath, IIS, password, LLM, and API wordlists plus expanded coverage across existing lists. • Adds filepaths wordlist for testing Single-page applications (SPAs). • Adds IIS default page and image files wordlist. • Adds `2024-197_most_used_passwords.txt` (derived from 2024-200_most_used_passwords) to Common-Credentials. • Expands LLM data-leakage payload wordlist with more entries. • Adds missing words to API 'actions' wordlists. • Adds more endpoints to `common.txt`, including 'daloradius'. • Adds protobuf mimetypes to relevant wordlists. • Expands `combined_subdomains.txt` with more subdomain entries. • Greatly expands 'Amounts' wordlists. • Updates `spring-boot.txt` to cover Spring Boot v2.1.7 endpoints. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/seclists