Wordlists

Offline cracking and online spraying. rockyou for a first pass, the big leaked sets when it holds out, rules to stretch a small list into a large one.

• rockyou.txt default
  /usr/share/wordlists/rockyou.txt

  14M real leaked passwords · the universal first pass.

  when Cracking any hash or NetNTLM capture · always start here. Kali ships it gzipped: gunzip it once.

• 10-million top 1M
  /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt

  The million most common passwords, frequency-ranked.

  when A larger, cleaner pass when rockyou comes up empty · or a fast top-N spray.

• darkweb2017 top 10k spraying
  /usr/share/seclists/Passwords/darkweb2017-top10000.txt

  The 10k most common passwords from the 2017 dark-web dumps.

  when Password spraying AD: small enough to stay under lockout, strong hit rate.

• Default credentials
  /usr/share/seclists/Passwords/Default-Credentials/default-passwords.csv

  Vendor default user:pass pairs by product.

  when A login panel, router, DB, or appliance that may never have been changed.

• best64.rule rules
  /usr/share/hashcat/rules/best64.rule

  The 64 highest-yield mangling rules for hashcat.

  when Squeezing more out of any list: hashcat -r best64.rule before going bigger.

• OneRuleToRuleThemAll ↗ external
  ~/OneRuleToRuleThemAll.rule

  A single heavy rule set that folds in the best public rules.

  when One serious GPU pass on a stubborn hash before you escalate to a bigger list.

Directory and file discovery. raft lists are drawn from real responses (better signal than brute); directory-list-2.3 goes deep when raft runs dry.

• raft-large-directories default
  /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt

  Directories seen in real-world responses, frequency-ordered.

  when The default first ffuf/feroxbuster directory pass · high signal, low noise.

• directory-list-2.3-medium
  /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

  The classic deep dirbuster list, ~220k entries.

  when raft came up short and you want depth · expect longer runs.

• common.txt
  /usr/share/seclists/Discovery/Web-Content/common.txt

  A tight ~4.7k list of the usual web paths.

  when A fast first look when time is short or the target is slow.

• raft-large-files
  /usr/share/seclists/Discovery/Web-Content/raft-large-files.txt

  Real filenames · pair with -e to append extensions.

  when Hunting backups, configs, and leftovers: .bak, .old, .zip, .config.

• API endpoints api
  /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt

  Common REST/API route fragments.

  when The target is an API or SPA backend · fuzz /api/, /v1/, and friends.

DNS brute-forcing to complement passive discovery. Start small and fast, widen only if the target warrants it.

• subdomains-top1million-5000 fast
  /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

  The 5k most common subdomain labels.

  when A quick DNS brute (ffuf/puredns) alongside subfinder · fast and usually enough.

• subdomains-top1million-110000
  /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt

  The 110k-label extended set.

  when A wide, in-scope target where 5k missed something worth the extra time.

• n0kovo_subdomains_huge ↗ huge
  ~/n0kovo_subdomains_huge.txt

  ~3M labels mined from mass internet scans.

  when Bug-bounty breadth on a resolver you control · pair with puredns + a resolver list.

Build the account list before you spray or roast. Short lists for a first look, name-derived lists when you know the naming scheme.

• top-usernames-shortlist fast
  /usr/share/seclists/Usernames/top-usernames-shortlist.txt

  The ~17 most common service/account names.

  when A fast first guess at admin, root, svc, and the usual suspects.

• xato-net 10M usernames
  /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

  The most common usernames from real breaches.

  when Broad username enumeration on a login or SMTP VRFY endpoint.

• Names (first/last)
  /usr/share/seclists/Usernames/Names/names.txt

  Human first and last names.

  when Feed a username generator (e.g. namemash) to build j.doe / jdoe / doej lists for AD.

Payload lists for the injection classes. Point them at a discovered parameter to probe LFI, XSS, SQLi, and the edges special characters expose.

• burp-parameter-names
  /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt

  ~2.5k common parameter names.

  when Hidden-parameter discovery with ffuf or Arjun before you fuzz values.

• LFI-Jhaddix
  /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt

  Path-traversal and local-file-inclusion payloads.

  when A parameter that loads a file · sweep for traversal and wrappers.

• XSS payloads
  /usr/share/seclists/Fuzzing/XSS/XSS-Jhaddix.txt

  Reflected/stored XSS probe strings.

  when A reflected input · fuzz for a context that fires, then hand-craft.

• Quick-SQLi
  /usr/share/seclists/Fuzzing/SQLi/Generic-SQLi.txt

  Generic SQL-injection probe strings.

  when A first manual poke before reaching for sqlmap.

• special-chars
  /usr/share/seclists/Fuzzing/special-chars.txt

  Single special characters, one per line.

  when Mapping how an input handles quotes, brackets, and metacharacters.

The non-web lists: SNMP community strings, default appliance creds, and the small sets that open a service without touching a browser.

• SNMP community strings
  /usr/share/seclists/Discovery/SNMP/snmp.txt

  Common SNMP community strings.

  when UDP 161 is open · brute the community string with onesixtyone or snmpwalk.

• Default passwords (by vendor)
  /usr/share/seclists/Passwords/Default-Credentials/

  Per-product default-credential lists.

  when A named appliance or device · try the vendor set before brute-forcing.

• ftp-betterdefaultpasslist
  /usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt

  Common FTP default user:pass pairs.

  when FTP is open and anonymous is off · a quick default-cred pass.