Security Wordlists

SecLists & wordlist locations

This installer clones SecLists and PayloadsAllTheThings during install via git clone into $GITHUB_TOOL_DIR — /opt on Linux (root/sudo install), ~/tools on Termux. Use these paths instead of downloading new wordlists.

Where things live

$GITHUB_TOOL_DIR is the install root: /opt on a standard Linux install, ~/tools on Termux. The paths below use /opt; swap in ~/tools on Termux.

Kali ships /usr/share/seclists/ and /usr/share/wordlists/rockyou.txt pre-baked, but this installer does not create those — it clones to $GITHUB_TOOL_DIR. Only fall back to the Kali paths if you are on Kali and they already exist.

# Find your install root (Linux clone first, then Termux, then Kali pre-baked)
ls /opt/SecLists/ 2>/dev/null || ls ~/tools/SecLists/ 2>/dev/null || ls /usr/share/seclists/

Common picks per task

Web content discovery (ffuf / gobuster)

SECLISTS="${GITHUB_TOOL_DIR:-/opt}/SecLists"  # /opt on Linux, ~/tools on Termux

# Quick pass
$SECLISTS/Discovery/Web-Content/common.txt

# Heavier
$SECLISTS/Discovery/Web-Content/raft-large-directories.txt
$SECLISTS/Discovery/Web-Content/big.txt

# API paths
$SECLISTS/Discovery/Web-Content/api/api-endpoints.txt
$SECLISTS/Discovery/Web-Content/api/objects.txt

# Backups / leftover files
$SECLISTS/Discovery/Web-Content/Common-PHP-Filenames.txt
$SECLISTS/Discovery/Web-Content/quickhits.txt

# Tech-specific
$SECLISTS/Discovery/Web-Content/CMS/wp-plugins.fuzz.txt
$SECLISTS/Discovery/Web-Content/Apache.fuzz.txt
$SECLISTS/Discovery/Web-Content/Tomcat.fuzz.txt

Subdomain enum

$SECLISTS/Discovery/DNS/subdomains-top1million-5000.txt
$SECLISTS/Discovery/DNS/subdomains-top1million-110000.txt
$SECLISTS/Discovery/DNS/dns-Jhaddix.txt

Username enum

$SECLISTS/Usernames/top-usernames-shortlist.txt
$SECLISTS/Usernames/Names/names.txt
$SECLISTS/Usernames/cirt-default-usernames.txt

Password cracking (hashcat / john / hydra)

$SECLISTS/Passwords/Common-Credentials/10-million-password-list-top-1000.txt
$SECLISTS/Passwords/Common-Credentials/10-million-password-list-top-10000.txt
$SECLISTS/Passwords/Common-Credentials/10-million-password-list-top-100000.txt
$SECLISTS/Passwords/Leaked-Databases/rockyou.txt.tar.gz
$SECLISTS/Passwords/Default-Credentials/default-passwords.csv

Fuzzing payloads

$SECLISTS/Fuzzing/SQLi/Generic-SQLi.txt
$SECLISTS/Fuzzing/XSS/XSS-Jhaddix.txt
$SECLISTS/Fuzzing/LFI/LFI-Jhaddix.txt
$SECLISTS/Fuzzing/SSRF.txt
$SECLISTS/Fuzzing/big-list-of-naughty-strings.txt   # input validation
$SECLISTS/Fuzzing/special-chars.txt
$SECLISTS/Fuzzing/User-Agents/UserAgents.fuzz.txt

PayloadsAllTheThings

Categorised by vulnerability class — read the README for each folder. Paths below use /opt (swap in ~/tools on Termux); set PATT="${GITHUB_TOOL_DIR:-/opt}/PayloadsAllTheThings". Highlights:

/opt/PayloadsAllTheThings/SQL Injection/                 # SQLi cheatsheets + bypasses
/opt/PayloadsAllTheThings/XSS Injection/                 # XSS variants + WAF bypass
/opt/PayloadsAllTheThings/Server Side Template Injection/
/opt/PayloadsAllTheThings/Server Side Request Forgery/
/opt/PayloadsAllTheThings/Insecure Deserialization/
/opt/PayloadsAllTheThings/CSV Injection/
/opt/PayloadsAllTheThings/JSON Web Token/
/opt/PayloadsAllTheThings/Methodology and Resources/     # cheatsheets per topic

Pattern-matching (regex catalogs)

For grep'ing logs/source for secrets:

$SECLISTS/Pattern-Matching/api-keys.txt              # API key shapes
$SECLISTS/Pattern-Matching/keywords.txt              # secret/token keywords

Or use purpose-built tools: trufflehog, gitleaks, detect-secrets.

Web shells

$SECLISTS/Web-Shells/ for testing upload bypasses on a CTF — never use these on real targets without authorization.

Don't

• Download wordlists from random gists when SecLists already has the canonical version
• Use rockyou.txt for hashcat without first knowing the hash type — pick a smaller list and graduate up
• Forget to untar rockyou from SecLists (/opt/SecLists/Passwords/Leaked-Databases/rockyou.txt.tar.gz); on Kali it is pre-baked at /usr/share/wordlists/rockyou.txt.gz