retour aux outils back to tools Ducklings

SecLists

Immense collection organisée de wordlists pour les audits de sécurité : identifiants, mots de passe, URL/chemins, payloads de fuzzing, et motifs de données sensibles. Huge curated collection of wordlists for security assessments — usernames, passwords, URLs/paths, fuzzing payloads, and sensitive-data patterns.

↗ https://github.com/danielmiessler/SecLists

Overview

SecLists is the standard reference collection of wordlists used across nearly every phase of an assessment: password/username lists for credential attacks, discovery lists for content/directory brute forcing, payload lists for fuzzing (XSS, SQLi, LFI, SSTI, etc.), and pattern lists for spotting sensitive data. On Kali it ships pre-installed under /usr/share/seclists/ and is the default input for tools like gobuster, ffuf, hydra, and wfuzz.

Common Usage

Explore the top-level categories

ls /usr/share/seclists/

Password cracking / spraying — the classic list

/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt

Web content discovery

gobuster dir -u https://<target> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

Subdomain brute forcing

ffuf -u https://FUZZ.<domain> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Username enumeration / password spraying against a login form

hydra -L /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt \
      -p 'Summer2026!' <target> http-post-form '/login:user=^USER^&pass=^PASS^:F=incorrect'

XSS fuzzing payloads for a parameter

ffuf -u "https://<target>/search?q=FUZZ" -w /usr/share/seclists/Fuzzing/XSS/XSS-BypassWAF-1.txt

Tips

  • Discovery/Web-Content/ has size-tiered lists (-small, -medium, -big) — start small on noisy/rate-limited targets
  • Passwords/Common-Credentials/ includes vendor-default and top-N lists that are far more effective for spraying than dumping all of rockyou.txt
  • Fuzzing/ holds category-specific payload sets (SQLi, LFI, SSTI, command injection, Unicode/WAF bypass) worth pointing straight at Burp Intruder/ffuf
Help / Man page 
SecLists is a data collection, not a binary — there is no CLI to invoke.

Installed layout on Kali (/usr/share/seclists/):
  Discovery/        Web-Content, DNS, SNMP, etc. — directory & subdomain lists
  Fuzzing/           payload lists per vuln class (XSS, SQLi, LFI, SSTI, ...)
  Passwords/         leaked-database dumps, common credentials, default creds
  Usernames/         username lists, name-based generators
  Pattern-Matching/  regexes for finding sensitive data in source/output
  Payloads/          misc exploit/test payloads

Use `find /usr/share/seclists -iname '*<keyword>*'` to locate a specific list.

Vue d’ensemble

SecLists est la collection de référence de wordlists utilisée dans presque toutes les phases d’une mission : listes de mots de passe/identifiants pour les attaques d’identifiants, listes de découverte pour le brute-force de contenu/répertoires, listes de payloads pour le fuzzing (XSS, SQLi, LFI, SSTI, etc.), et listes de motifs pour repérer des données sensibles. Sur Kali, elle est préinstallée dans /usr/share/seclists/ et constitue l’entrée par défaut pour des outils comme gobuster, ffuf, hydra et wfuzz.

Utilisation courante

# Explorer les catégories de premier niveau
ls /usr/share/seclists/

# Cracking / spraying de mots de passe : la liste classique
/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt

# Découverte de contenu web
gobuster dir -u https://<target> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

# Brute-force de sous-domaines
ffuf -u https://FUZZ.<domain> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Énumération d'utilisateurs / password spraying contre un formulaire de connexion
hydra -L /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt \
      -p 'Summer2026!' <target> http-post-form '/login:user=^USER^&pass=^PASS^:F=incorrect'

# Payloads de fuzzing XSS pour un paramètre
ffuf -u "https://<target>/search?q=FUZZ" -w /usr/share/seclists/Fuzzing/XSS/XSS-BypassWAF-1.txt

Conseils

  • Discovery/Web-Content/ contient des listes graduées par taille (-small, -medium, -big) : commencer petit sur des cibles bruyantes ou avec rate-limiting
  • Passwords/Common-Credentials/ inclut des listes d’identifiants par défaut des éditeurs et de top-N, bien plus efficaces pour le spraying que de dumper l’intégralité de rockyou.txt
  • Fuzzing/ contient des jeux de payloads spécifiques par classe de vulnérabilité (SQLi, LFI, SSTI, injection de commande, contournement Unicode/WAF), à pointer directement vers Burp Intruder/ffuf
Aide / Page de manuel 
SecLists is a data collection, not a binary — there is no CLI to invoke.

Installed layout on Kali (/usr/share/seclists/):
  Discovery/        Web-Content, DNS, SNMP, etc. — directory & subdomain lists
  Fuzzing/           payload lists per vuln class (XSS, SQLi, LFI, SSTI, ...)
  Passwords/         leaked-database dumps, common credentials, default creds
  Usernames/         username lists, name-based generators
  Pattern-Matching/  regexes for finding sensitive data in source/output
  Payloads/          misc exploit/test payloads

Use `find /usr/share/seclists -iname '*<keyword>*'` to locate a specific list.