Best SecLists Wordlists for Directory Enumeration: The Complete Guide

The optimal SecLists wordlists for directory enumeration are located in Discovery/Web-Content/ and include common_directories.txt for rapid reconnaissance, the graduated raft series (small to large) for scalable depth, and combined_directories.txt for comprehensive coverage.

The danielmiessler/SecLists repository is the security industry’s definitive collection of payloads for penetration testing and vulnerability assessment. For directory enumeration—the systematic discovery of hidden or undocumented paths on web servers—SecLists provides battle-tested wordlists curated from real-world deployments, CMS defaults, and historical breach data under the Discovery/Web-Content/ directory.

Top Recommended SecLists Wordlists for Directory Enumeration

combined_directories.txt – The All-in-One Solution

With approximately 10,000 entries, combined_directories.txt merges the common, raft, and custom directory sets into a single master list. This is the optimal choice when you need maximum coverage without managing multiple files. The list aggregates high-probability paths from public site crawls and security assessments.

Use this for comprehensive scans when time permits thorough enumeration. File path: Discovery/Web-Content/combined_directories.txt.

common_directories.txt – High-Frequency Targets

At roughly 150 entries, common_directories.txt contains only the highest-frequency directory names found in production environments (e.g., admin, api, backup). This minimal set generates minimal traffic and noise, making it ideal for first-pass scans on sensitive production targets or when bandwidth is constrained.

File path: Discovery/Web-Content/common_directories.txt.

The Raft Series – Scalable Depth Coverage

The raft wordlists provide graduated enumeration depth sourced from the AELS subdirectories-discover project:

• raft-small-directories.txt (~3,000 entries): Low-profile scans offering a balance of coverage versus speed. File path: Discovery/Web-Content/raft-small-directories.txt.
• raft-medium-directories.txt (~9,000 entries): Mid-range assessments requiring more depth while maintaining reasonable scan times. File path: Discovery/Web-Content/raft-medium-directories.txt.
• raft-large-directories.txt (~27,000 entries): Exhaustive enumeration for thorough security assessments; expect significantly longer runtimes. File path: Discovery/Web-Content/raft-large-directories.txt.

DirBuster Legacy Lists

For compatibility with legacy tools or specific case-handling requirements, SecLists includes the DirBuster-2007 series:

• Discovery/Web-Content/DirBuster-2007_directory-list-small.txt
• Discovery/Web-Content/DirBuster-2007_directory-list-medium.txt
• Discovery/Web-Content/DirBuster-2007_directory-list-big.txt

These variants include lowercase versions (*-lowercase.txt) to avoid false negatives on case-insensitive Windows servers.

big.txt – Mixed Directory and File Enumeration

Containing approximately 6,000 entries, big.txt combines both directory names and common files (e.g., robots.txt, config.php). This hybrid list is efficient when you need simultaneous discovery of paths and files without switching wordlists.

File path: Discovery/Web-Content/big.txt.

Wordlist Structure and Format

All SecLists directory wordlists follow a standardized plain-text format:

• One entry per line without leading slashes (e.g., wp-content, admin, api/v1)
• Lowercase variants (*-lowercase.txt) provided for case-insensitive environments
• Directory-specific files filtered to exclude file extensions, keeping the focus purely on path discovery

According to the README.md in Discovery/Web-Content/, these lists are maintained from upstream sources including the AELS subdirectories-discover project.

Practical Usage Examples with Popular Tools

Gobuster (Fast Directory Enumeration)

# Quick scan with high-frequency directories

gobuster dir -u https://example.com -w /path/to/SecLists/Discovery/Web-Content/common_directories.txt -t 50 -x php,html,js

# Comprehensive scan with combined list

gobuster dir -u https://example.com -w /path/to/SecLists/Discovery/Web-Content/combined_directories.txt -t 100 -x php,html,js,txt

Dirb (Classic HTTP Scanner)

# Case-insensitive small raft scan

dirb https://example.com /path/to/SecLists/Discovery/Web-Content/raft-small-directories-lowercase.txt -X .php,.html,.js

# Deep assessment with large raft

dirb https://example.com /path/to/SecLists/Discovery/Web-Content/raft-large-directories.txt -X .php,.html,.js

FFUF (Fast Web Fuzzer)

# Medium raft with recursive fuzzing

ffuf -u https://example.com/FUZZ -w /path/to/SecLists/Discovery/Web-Content/raft-medium-directories.txt -e php,html,js -t 200

# Mixed enumeration using big.txt

ffuf -u https://example.com/FUZZ -w /path/to/SecLists/Discovery/Web-Content/big.txt -e php,html,js,txt -t 150

Burp Suite Intruder

1. Navigate to Target → Site map, right-click the host, and select Intruder → Positions.
2. Mark the directory position with the FUZZ payload marker (e.g., https://example.com/FUZZ/).
3. In the Payloads tab, click Load and select your chosen wordlist from Discovery/Web-Content/.

Summary

• Start with common_directories.txt (~150 entries) for initial reconnaissance on production systems to minimize noise and bandwidth.
• Scale progressively through raft-small-directories.txt (~3k) to raft-large-directories.txt (~27k) based on time constraints and target scope.
• Use combined_directories.txt (~10k) when you need comprehensive coverage in a single file without managing multiple lists.
• Select lowercase variants (*-lowercase.txt) when targeting case-insensitive servers to prevent false negatives.
• Reference big.txt for hybrid directory and file discovery when you need to identify both paths and sensitive files simultaneously.

Frequently Asked Questions

Which SecLists wordlist should I use for a quick directory enumeration scan?

For rapid reconnaissance, use common_directories.txt from Discovery/Web-Content/. With approximately 150 high-frequency entries, it covers the most common administrative paths, API endpoints, and backup directories while generating minimal traffic and avoiding rate-limit triggers.

How do I avoid case-sensitivity issues when using SecLists for directory enumeration?

Use the lowercase variants provided for many wordlists (e.g., raft-small-directories-lowercase.txt or the DirBuster-2007_directory-list-*-lowercase.txt files). These eliminate uppercase characters that might cause false negatives on Windows IIS servers or other case-insensitive web platforms.

What is the difference between the raft and DirBuster wordlists in SecLists?

The raft series (small, medium, large) represents modern, actively maintained lists sourced from the AELS subdirectories-discover project with graduated depth levels. The DirBuster lists are legacy compatibility files from the original OWASP DirBuster tool, provided for users requiring historical consistency or specific tool integrations.

Can I use SecLists wordlists for both directory and file enumeration?

Yes. While the *-directories.txt files contain only path names, big.txt and combined_words.txt include both directories and file names. For pure directory enumeration, stick to the specific *-directories.txt files; for mixed discovery, use big.txt or pair directory wordlists with file extension lists using your tool’s extension flag (e.g., -x in Gobuster or -e in FFUF).

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}