How to Use SecLists for Credential Stuffing Attacks

SecLists provides curated username and password wordlists that enable security professionals to assemble dictionaries for credential stuffing against authentication endpoints.

Credential stuffing attacks automate the injection of breached credentials to identify valid user accounts. The danielmiessler/SecLists repository is the industry's standard collection of wordlists, organized specifically to support these security testing workflows. Understanding how to select and combine files from the Usernames, Passwords, and Default-Credentials directories allows you to construct high-efficiency payload sets.

Understanding SecLists Structure for Credential Attacks

The repository organizes wordlists into logical top-level directories designed for different phases of credential testing. According to the source documentation in Passwords/README.md, the directory contains lists intended for use by multiple tools when attempting to guess credentials for targeted services.

Key directories for credential stuffing include:

• Usernames/ – Contains collections like xato-net-10-million-usernames.txt, which provides 10 million usernames scraped from public data breaches and services.
• Passwords/Common-Credentials/ – Houses general password dictionaries including xato-net-10-million-passwords.txt, offering massive datasets for brute-force combinations.
• Passwords/Default-Credentials/ – Stores vendor-specific default login pairs such as scada-pass.csv, containing combinations like admin:admin that often bypass lockout thresholds on hardware devices.
• Passwords/withcount/ – Provides frequency-sorted lists like 10k-most-common-withcount.txt, which include occurrence counts to prioritize the most statistically common passwords first.

To maintain current data, reference .bin/wordlist-updaters/README.md for scripts that automate list updates.

Building Credential-Stuffing Payloads

Creating effective credential-stuffing attacks requires strategic selection and combination of these wordlists. Follow this workflow to assemble your payloads:

1. Select appropriate base lists – For generic web applications, combine Usernames/xato-net-10-million-usernames.txt with Passwords/Common-Credentials/10k-most-common.txt to cover high-probability combinations without generating excessive request volume.
2. Prioritize by frequency – Use files from Passwords/withcount/ to ensure your attack attempts the most common credentials first, reducing total requests needed to find valid pairs.
3. Choose combination strategy – Determine whether to use Cartesian product (every username against every password) for exhaustive coverage, or pairwise matching (pre-matched username:password dumps) when testing specific breach data.
4. Integrate default credentials – Include relevant entries from Passwords/Default-Credentials/ to test for unchanged factory settings, particularly effective against IoT devices and industrial control systems.

Implementing Cartesian Product Attacks with Python

The Cartesian product approach tests every username against every password, making it essential to limit initial list sizes. The following Python script demonstrates how to load SecLists files and execute controlled credential stuffing with rate limiting:

import itertools
import requests
from time import sleep

# Paths inside the cloned SecLists repo

USERFILE = "SecLists/Usernames/xato-net-10-million-usernames.txt"
PASSFILE = "SecLists/Passwords/Common-Credentials/xato-net-10-million-passwords.txt"

# Target endpoint (example)

LOGIN_URL = "https://example.com/login"

def load_lines(path, limit=None):
    """Yield stripped lines, optionally stop after `limit` entries."""
    with open(path, "r", encoding="utf-8", errors="ignore") as f:
        for i, line in enumerate(f):
            if limit and i >= limit:
                break
            yield line.strip()

# Load a *manageable* subset (e.g., first 500 users & 100 passwords)

users = list(itertools.islice(load_lines(USERFILE), 500))
passwords = list(itertools.islice(load_lines(PASSFILE), 100))

session = requests.Session()

# Optional: rotate proxies, set timeouts, etc.

for user, pwd in itertools.product(users, passwords):
    resp = session.post(
        LOGIN_URL,
        data={"username": user, "password": pwd},
        timeout=10,
    )
    if "Welcome" in resp.text:               # Adjust success detection

        print(f"[+] Valid pair → {user}:{pwd}")
        break                                 # Stop after first success

    # Respect rate limits

    sleep(0.2)  # 5 requests per second

This implementation uses itertools.product to generate combinations from the SecLists wordlists while implementing sleep(0.2) to maintain a 5-requests-per-second rate limit, preventing account lockouts during testing.

Using Pre-Matched Credentials with Hydra

When testing specific breach dumps where usernames and passwords are already paired, use Hydra with the -C flag to avoid unnecessary Cartesian multiplication. This approach dramatically reduces request count and detection footprint:

# Convert a breach CSV to the "user:pass" format expected by Hydra

awk -F',' '{print $1 ":" $2}' breach_dump.csv > creds.txt

# Run Hydra against an HTTP POST login form

hydra -C creds.txt example.com http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid"

You can generate creds.txt from any SecLists-style dump. Hydra's -C option reads colon-separated user:pass pairs directly, testing only specific combinations rather than every possible permutation.

Strategic Considerations for Effective Testing

Successful credential stuffing requires balancing thoroughness with stealth and legal compliance:

• Rate limiting – Implement delays between requests (as shown in the Python example) and rotate through HTTP/SOCKS proxies to circumvent IP-based restrictions.
• Noise reduction – Prioritize Passwords/withcount/ variants to test high-frequency passwords first, minimizing the attack footprint while maximizing hit rates.
• Target-specific defaults – Consult Passwords/Default-Credentials/scada-pass.csv when testing network infrastructure or embedded devices where factory credentials often persist unchanged.
• Legal boundaries – Only execute credential stuffing against systems you own or have explicit written authorization to test. Unauthorized access attempts violate computer fraud statutes regardless of the tools used.

Summary

• SecLists organizes credential data into Usernames/, Passwords/Common-Credentials/, Passwords/Default-Credentials/, and Passwords/withcount/ directories for targeted testing.
• Use Cartesian product (itertools.product) for exhaustive username-password combination testing, or pairwise mode (hydra -C) for pre-matched breach data.
• Prioritize frequency-sorted withcount files and limit request rates to avoid detection and account lockouts.
• Reference Passwords/README.md for detailed descriptions of list purposes and intended use cases.
• Always ensure explicit authorization before testing credentials against any system.

Frequently Asked Questions

What is the difference between regular password lists and the "withcount" versions in SecLists?

The withcount directory contains password lists that include occurrence frequency data alongside each entry, typically formatted as count:password. This allows you to sort or filter by popularity, ensuring you test the most common credentials first. Testing high-frequency passwords initially increases efficiency and reduces the total number of requests needed to identify valid accounts during credential stuffing campaigns.

How can I prevent account lockouts when using SecLists for credential stuffing?

Implement rate limiting in your testing tools, such as the sleep(0.2) delay in the Python example to restrict requests to 5 per second. Additionally, rotate through proxy servers to distribute requests across multiple IP addresses, and prioritize high-probability credentials from withcount files to minimize the number of failed attempts per account before finding valid credentials.

Are the default credentials in SecLists effective against production systems?

The Passwords/Default-Credentials/ directory, including files like scada-pass.csv, remains highly effective against Internet of Things (IoT) devices, industrial control systems (ICS), and enterprise hardware that often ships with unchanged factory settings. While modern web applications rarely use default credentials, network infrastructure and embedded devices frequently do, making these lists essential for comprehensive security assessments.

Is it legal to use SecLists for credential stuffing attacks?

Using SecLists is legal for authorized security testing against systems you own or have explicit written permission to assess. However, using these wordlists against third-party services without authorization constitutes unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA) and similar international statutes. Always obtain proper authorization and operate within defined rules of engagement.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}