# danielmiessler/SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

Repository: https://github.com/danielmiessler/SecLists
Canonical: https://ross.abutalabs.com/products/seclists
Homepage: https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project
Language: PHP
License: MIT
License Family: permissive
Last push: 2026-08-26T11:12:02+00:00

## Health v2 (maintenance only)
Score: 83/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 52, longevity 100
- inputs: {"age_days": 5310, "days_push": 7, "days_rel": 163, "gap_med": 119.5, "n_releases_24m": 5}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 73106, forks 25100 (observed 2026-08-28T04:12:21.256031+00:00)

## What it is
SecLists is a curated collection of security testing lists including usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, and web shells. It is designed to be pulled onto a testing box so security testers have every type of list they may need during assessments.

## Use cases
- find wordlists for brute-forcing passwords
- get fuzzing payloads for web app testing
- list of common usernames for security assessment
- directory and file discovery wordlists for dirbusting
- sensitive data patterns for scanning
- web shell samples for pentesting
- subdomain enumeration wordlists

## When to choose
- you need a comprehensive, well-maintained collection of security testing lists in one place
- you are doing penetration testing, bug bounty, or CTF challenges
- you want wordlists compatible with tools like ffuf, gobuster, or hydra

## When to avoid
- you need a small, targeted wordlist rather than a large multi-gigabyte repository
- you need programmatically generated or frequently auto-updated wordlists (e.g., Assetnote Wordlists)
- you are not doing security testing and just need general-purpose data lists

## Facets
- artifact type: dataset
- maturity: active
- function: security, penetration-testing, fuzzing, osint
- domain: security, penetration-testing, developer-tools
- platform: windows, cli
- tags: wordlists, payloads, fuzzdb, brute-force, security-testing, kali-linux, linux, macos

## Member repositories
- danielmiessler/SecLists (main) score 83

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:12:21.256031+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T16:15:24.638038+00:00, confidence not recorded.
  - readme: https://github.com/danielmiessler/SecLists (fetched 2026-08-28T04:12:21.256031+00:00, sha 9b1f76ef2150)
  - homepage: https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project (fetched 2026-08-28T17:46:36.473986+00:00, sha 3078b512fdef)
  - site_page: https://owasp.org/about/ (fetched 2026-08-28T17:46:36.476064+00:00, sha f0bbba449267)
- Data as of 2026-08-30T08:39:29.467469+00:00.