← retour aux outils back to tools

# SecLists

Immense collection organisée de wordlists pour les audits de sécurité : identifiants, mots de passe, URL/chemins, payloads de fuzzing, et motifs de données sensibles. Huge curated collection of wordlists for security assessments — usernames, passwords, URLs/paths, fuzzing payloads, and sensitive-data patterns.

↗ https://github.com/danielmiessler/SecLists

## Overview

SecLists is the standard reference collection of wordlists used across nearly every phase of an assessment: password/username lists for credential attacks, discovery lists for content/directory brute forcing, payload lists for fuzzing (XSS, SQLi, LFI, SSTI, etc.), and pattern lists for spotting sensitive data. On Kali it ships pre-installed under `/usr/share/seclists/` and is the default input for tools like `gobuster`, `ffuf`, `hydra`, and `wfuzz`.

## Common Usage

Explore the top-level categories

    ls /usr/share/seclists/

Password cracking / spraying — the classic list

    /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt

Web content discovery

    gobuster dir -u https://<target> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

Subdomain brute forcing

    ffuf -u https://FUZZ.<domain> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Username enumeration / password spraying against a login form

    hydra -L /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt \
          -p 'Summer2026!' <target> http-post-form '/login:user=^USER^&pass=^PASS^:F=incorrect'

XSS fuzzing payloads for a parameter

    ffuf -u "https://<target>/search?q=FUZZ" -w /usr/share/seclists/Fuzzing/XSS/XSS-BypassWAF-1.txt

## Tips

- `Discovery/Web-Content/` has size-tiered lists (`-small`, `-medium`, `-big`) — start small on noisy/rate-limited targets
- `Passwords/Common-Credentials/` includes vendor-default and top-N lists that are far more effective for spraying than dumping all of rockyou.txt
- `Fuzzing/` holds category-specific payload sets (SQLi, LFI, SSTI, command injection, Unicode/WAF bypass) worth pointing straight at Burp Intruder/ffuf

Help / Man page

    SecLists is a data collection, not a binary — there is no CLI to invoke.

    Installed layout on Kali (/usr/share/seclists/):
      Discovery/        Web-Content, DNS, SNMP, etc. — directory & subdomain lists
      Fuzzing/           payload lists per vuln class (XSS, SQLi, LFI, SSTI, ...)
      Passwords/         leaked-database dumps, common credentials, default creds
      Usernames/         username lists, name-based generators
      Pattern-Matching/  regexes for finding sensitive data in source/output
      Payloads/          misc exploit/test payloads

    Use `find /usr/share/seclists -iname '*<keyword>*'` to locate a specific list.

## Vue d’ensemble

SecLists est la collection de référence de wordlists utilisée dans presque toutes les phases d’une mission : listes de mots de passe/identifiants pour les attaques d’identifiants, listes de découverte pour le brute-force de contenu/répertoires, listes de payloads pour le fuzzing (XSS, SQLi, LFI, SSTI, etc.), et listes de motifs pour repérer des données sensibles. Sur Kali, elle est préinstallée dans `/usr/share/seclists/` et constitue l’entrée par défaut pour des outils comme `gobuster`, `ffuf`, `hydra` et `wfuzz`.

## Utilisation courante

    # Explorer les catégories de premier niveau
    ls /usr/share/seclists/

    # Cracking / spraying de mots de passe : la liste classique
    /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt

    # Découverte de contenu web
    gobuster dir -u https://<target> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

    # Brute-force de sous-domaines
    ffuf -u https://FUZZ.<domain> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

    # Énumération d'utilisateurs / password spraying contre un formulaire de connexion
    hydra -L /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt \
          -p 'Summer2026!' <target> http-post-form '/login:user=^USER^&pass=^PASS^:F=incorrect'

    # Payloads de fuzzing XSS pour un paramètre
    ffuf -u "https://<target>/search?q=FUZZ" -w /usr/share/seclists/Fuzzing/XSS/XSS-BypassWAF-1.txt

## Conseils

- `Discovery/Web-Content/` contient des listes graduées par taille (`-small`, `-medium`, `-big`) : commencer petit sur des cibles bruyantes ou avec rate-limiting
- `Passwords/Common-Credentials/` inclut des listes d’identifiants par défaut des éditeurs et de top-N, bien plus efficaces pour le spraying que de dumper l’intégralité de rockyou.txt
- `Fuzzing/` contient des jeux de payloads spécifiques par classe de vulnérabilité (SQLi, LFI, SSTI, injection de commande, contournement Unicode/WAF), à pointer directement vers Burp Intruder/ffuf

Aide / Page de manuel

    SecLists is a data collection, not a binary — there is no CLI to invoke.

    Installed layout on Kali (/usr/share/seclists/):
      Discovery/        Web-Content, DNS, SNMP, etc. — directory & subdomain lists
      Fuzzing/           payload lists per vuln class (XSS, SQLi, LFI, SSTI, ...)
      Passwords/         leaked-database dumps, common credentials, default creds
      Usernames/         username lists, name-based generators
      Pattern-Matching/  regexes for finding sensitive data in source/output
      Payloads/          misc exploit/test payloads

    Use `find /usr/share/seclists -iname '*<keyword>*'` to locate a specific list.