Hacker GitHub

← All repos

danielmiessler/SecLists

View on GitHub ↗ ★ 74,481 PHP

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

35 mentions on Hacker News by 35 people: 12 stories, 23 comments · first 2013-03-22 · latest 2026-07-04

Mentions per year 35 mentions · busiest year 2017 (7)
20082026
AllStoriesComments NewestTopOldest
  1. Now you might want to open a pr like this one: https://github.com/danielmiessler/SecLists/pull/155
    comment by alessandroberna · 2026-07-04 · in Hackers shoveled snow for company, were rewarded with network admin access
  2. You could ask for your password to be removed from the list: https://github.com/danielmiessler/SecLists/pull/155
    comment by 3eb7988a1663 · 2025-11-16 · in Why Bcrypt Can Be Unsafe for Password Hashing?
  3. check out the lists in this repo https://github.com/danielmiessler/SecLists/blob/master/Disco... I combined a few of the most interesting lists from here into one and never miss an attack now
    comment by efilife · 2025-05-03 · in I use zip bombs to protect my server
  4. Some bots scan using giant lists of subdomains, e.g. https://github.com/danielmiessler/SecLists/tree/master/Disco... . Your subdomain may be on that giant combined_subdomains list, or perhaps some other lists that other tools use.
    comment by jcalx · 2025-03-07 · in Ask HN: How did the internet discover my subdomain?
  5. ▲ 50
    Best Pull Request Ever
    story by sh_tomer · 2024-12-28 · 6 comments
  6. Mine too. Takes me back to when my password was leaked: https://github.com/danielmiessler/SecLists/pull/155
    comment by ethanjstark · 2024-12-06 · in Every V4 UUID
  7. …also are the person who put together a bunch of password lists[1] that are incredibly useful.) [1] https://github.com/danielmiessler/SecLists/
    comment by firefax · 2024-10-22 · in Vimium – The Hacker's Browser
  8. ▲ 2
    SecLists is the security tester's companion
    story by blacktechnology · 2024-10-17 · 0 comments
  9. Be sure to create a pr to remove your ssn from this list. Also your passwords: https://github.com/danielmiessler/SecLists/pull/155
    comment by pjot · 2024-08-17 · in Releasing everyone's SSN and the hacks used to acquire them
  10. …of frequently used passwords. Also in the repo is probably my favorite pull request ever [1]. [0] https://github.com/danielmiessler/SecLists [1] https://github.com/danielmiessler/SecLists/pull/155
    comment by fbdab103 · 2023-09-28 · in DarkBeam leaks billions of email and password combinations
  11. Github: https://github.com/danielmiessler/SecLists/tree/master/Passw...
    comment by slenk · 2022-12-25 · in LastPass user vaults stolen in recent hack
  12. …the most popular one million 12-character passwords that use A-Z/a-z/0-9? A good starting place is https://github.com/danielmiessler/SecLists/tree/master/Passw... > Second, the top 1M of 6/7/8 character passwords have a statistically…
    comment by bawolff · 2022-12-23 · in LastPass user vaults stolen in recent hack
  13. ▲ 62
    Remove my password from lists so hackers won't be able to hack me (2017)
    story by personjerry · 2022-08-17 · 13 comments
  14. Not a full security guide, but if you haven't seen this before it's useful to have... https://github.com/danielmiessler/SecLists/blob/master/Fuzzi...
    comment by harambae · 2022-02-15 · in DuckDuckGo \u202E
  15. just pick which size list you want to disallow: https://github.com/danielmiessler/SecLists/tree/master/Passw...
    comment by notatoad · 2021-09-03 · in Gift card gang extracts cash from 100k inboxes daily
  16. …those under your minimum helps too--only 47k remain after removing pws under 8 chars): https://github.com/danielmiessler/SecLists/blob/master/Passw...
    comment by Grieving · 2021-08-06 · in Mozilla: *Privacy Not Included
  17. …people to request their accidentally reproduced private data be redacted. See example below[0]. [0] https://github.com/danielmiessler/SecLists/pull/155
    comment by simonh · 2020-02-28 · in Programmers generate every possible melody in MIDI to prevent lawsuits
  18. ▲ 160
    Remove my password from lists so hackers won't be able to hack me (2017)
    story by srathi · 2019-10-18 · 55 comments
  19. At a guess, https://github.com/danielmiessler/SecLists/pull/155 ?
    comment by mpettitt · 2019-10-18 · in My Favourite Git Commit
  20. SecLists ( https://github.com/danielmiessler/SecLists ) contains a wealth of security-related lists of this sort, including a useful section containing the most common passwords.
    comment by davinic · 2018-11-16 · in Big List of Naughty Strings
  21. …There is a similar project, which I think is better organized and has more lists to play with: https://github.com/danielmiessler/SecLists
    comment by trash_panda · 2018-11-16 · in Big List of Naughty Strings
  22. I think the other half of his joke is this: https://github.com/danielmiessler/SecLists/pull/155
    comment by acranox · 2018-02-21 · in "Pwned Passwords" V2 With Half a Billion Passwords
  23. ▲ 1
    SecLists: the security tester's companion
    story by lobo_tuerto · 2017-12-28 · 0 comments
  24. ▲ 2
    SecLists is the security tester's companion
    story by febin · 2017-12-27 · 0 comments
  25. Are you sure it wasn't their password? https://github.com/danielmiessler/SecLists/pull/155#issuecom...
    comment by reificator · 2017-12-26 · in Remove my password from lists so hackers won't be able to hack me
  26. ▲ 504
    Remove my password from lists so hackers won't be able to hack me
    story by dEnigma · 2017-12-26 · 69 comments
  27. ▲ 5
    Remove my password from lists so hackers won't be able to hack me
    story by progval · 2017-12-22 · 1 comment
  28. ▲ 5
    Remove my password from lists so hackers won't be able to hack me
    story by mabynogy · 2017-12-21 · 0 comments
  29. …a collection of images like uber.gif and lottapixel.jpg[0], but it's just plain images. Hm. [0] - https://github.com/danielmiessler/SecLists/tree/master/Paylo...
    comment by 013 · 2017-01-06 · in Show HN: Image Files for Image-Upload testing [git]
  30. This has been my go-to for passwords for awhile. Top 100, 500, 1000, etc all the way to millions. https://github.com/danielmiessler/SecLists/tree/master/Passw...
    comment by onethumb · 2016-09-03 · in Millions of stolen Last.fm passwords have been decrypted. These are the top 50
  31. …do it, although NTLMv2 isn't explicitly mentioned. If your password is common (see something like https://github.com/danielmiessler/SecLists/tree/master/Passw... ) or <10 ASCII characters, it shouldn't take too long.
    comment by voltagex_ · 2016-08-02 · in Microsoft Live Account Credentials Leaking from Windows 8 and Above
  32. ▲ 1
    SecLists: the Security Tester's Companion
    story by striking · 2015-12-18 · 0 comments
  33. ▲ 2
    SecLists: usernames, passwords, URLs, sensitive data grep strings, and many more
    story by MrBra · 2015-10-27 · 0 comments
  34. Another good list that incorporates FuzzDB: https://github.com/danielmiessler/SecLists As other commenters noted, strings like DROP TABLES should be used with caution!
    comment by janfry · 2015-08-10 · in Show HN: Big List of Naughty Strings for testing user-input data
  35. ▲ 1
    SecLists, a collection of lists useful during security assessments
    story by morphics · 2013-03-22 · 0 comments