# How to Use SecLists for Directory Busting: A Complete Guide with Examples > Master directory busting with SecLists. Explore this guide to effectively use SecLists wordlists with tools like gobuster and ffuf for faster web content discovery. - Repository: [Daniel Miessler 🛡️/SecLists](https://github.com/danielmiessler/SecLists) - Tags: how-to-guide - Published: 2026-03-03 --- **To use SecLists for directory busting, clone the danielmiessler/SecLists repository and supply wordlist files from `Discovery/Web-Content/` (such as [`combined_directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_directories.txt) or [`raft-medium-directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/raft-medium-directories.txt)) to enumeration tools like gobuster, ffuf, or dirsearch via the `-w` flag.** SecLists is a curated collection of security testing wordlists maintained by Daniel Miessler. Learning how to use SecLists for directory busting allows security professionals to discover hidden endpoints, administrative panels, and configuration files on web servers. The repository's `Discovery/Web-Content` directory contains plaintext wordlists specifically optimized for HTTP directory enumeration. ## What Makes SecLists Ideal for Directory Enumeration SecLists provides several advantages over generic wordlists. Each list contains **newline-separated relative paths** (e.g., `admin`, `api/v1`, [`robots.txt`](https://github.com/danielmiessler/SecLists/blob/main/robots.txt)) that tools automatically append to target URLs. The repository offers **breadth and depth**, ranging from ~2,000 entry lists for quick scans to ~200,000 entries for exhaustive enumeration. Community-driven updates ensure the lists include newly discovered paths, while the simple text format guarantees compatibility with any HTTP directory enumeration utility. ## Core Directory Wordlists in SecLists The `Discovery/Web-Content/` directory contains the primary wordlists for directory busting. ### DirBuster Lists The classic DirBuster wordlists remain the industry standard for directory enumeration: - [`Discovery/Web-Content/DirBuster-2007_directory-list-2.3-small.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-small.txt) (~2,000 entries): Fast, low-noise scans against responsive targets - [`Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt) (~12,000 entries): Balanced coverage for most penetration testing scenarios - [`Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt) (~100,000 entries): Deep, exhaustive scans when time permits ### RAFT Directory Lists Derived from real-world site analysis, the RAFT lists offer focused alternatives: - [`Discovery/Web-Content/raft-small-directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/raft-small-directories.txt) (~3,000 entries): Small, targeted set based on actual discovered directories - [`Discovery/Web-Content/raft-medium-directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/raft-medium-directories.txt) (~15,000 entries): Comprehensive medium-size compilation ### Combined Directories The file [`Discovery/Web-Content/combined_directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/combined_directories.txt) (~200,000 entries) serves as a unified "one-stop" wordlist. This file is automatically generated by the GitHub Actions workflow defined in [`.github/workflows/wordlist-updater_combined_directories.yml`](https://github.com/danielmiessler/SecLists/blob/main/.github/workflows/wordlist-updater_combined_directories.yml), which concatenates individual DirBuster and RAFT lists while removing duplicates. ## How to Use SecLists for Directory Busting: Command Examples Below are concrete implementations using popular security tools with SecLists wordlists. ### gobuster gobuster remains one of the fastest directory busting tools. Use the `dir` mode with the `-w` flag to specify your SecLists path: ```bash gobuster dir \ -u https://target.example.com \ -w /path/to/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt \ -t 50 \ -x php,html,aspx \ -o gobuster-results.txt ``` The `-t 50` flag sets 50 concurrent threads, while `-x` appends file extensions to each directory entry. ### ffuf ffuf uses the `FUZZ` placeholder to mark injection points: ```bash ffuf -u https://target.example.com/FUZZ \ -w /path/to/SecLists/Discovery/Web-Content/raft-small-directories.txt \ -mc 200,204,301,302,403 \ -e .php,.html \ -o ffuf-results.json ``` The `-mc` flag filters for specific HTTP status codes, reducing noise from 404 responses. ### dirsearch For Python-based workflows, dirsearch accepts SecLists directly: ```bash python3 dirsearch.py \ -u https://target.example.com \ -w /path/to/SecLists/Discovery/Web-Content/combined_directories.txt \ --exclude-status 404,401 \ -e php,html,js \ -t 30 \ -o dirsearch-output.txt ``` Using [`combined_directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_directories.txt) provides comprehensive coverage while `--exclude-status` filters out authentication and not-found responses. ### Nmap http-enum The Nmap Scripting Engine can leverage SecLists via the `http-enum` script: ```bash nmap -p80,443 --script http-enum \ --script-args http-enum.maxpathlen=10,http-enum.dirlist=/path/to/SecLists/Discovery/Web-Content/raft-medium-directories.txt \ target.example.com ``` This integrates directory busting into broader network scanning workflows without requiring separate tool installation. ### DirBuster (GUI/CLI) If you prefer the original DirBuster tool, load any of the `DirBuster-2007_directory-list-*.txt` files into the **Wordlist** field. The GUI automatically iterates through entries, prepending the target URL to each path in the list. ## Selecting the Optimal Wordlist Size Choose your wordlist based on time constraints and target sensitivity: - **Small lists** ([`DirBuster-2007_directory-list-2.3-small.txt`](https://github.com/danielmiessler/SecLists/blob/main/DirBuster-2007_directory-list-2.3-small.txt) or [`raft-small-directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/raft-small-directories.txt)): Use for quick validation checks or when targeting high-performance production servers where request volume must remain low. - **Medium lists** ([`DirBuster-2007_directory-list-2.3-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/DirBuster-2007_directory-list-2.3-medium.txt) or [`raft-medium-directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/raft-medium-directories.txt)): Ideal for standard penetration tests, offering the best balance between coverage and scan duration. - **Large lists** ([`combined_directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_directories.txt) or [`DirBuster-2007_directory-list-2.3-big.txt`](https://github.com/danielmiessler/SecLists/blob/main/DirBuster-2007_directory-list-2.3-big.txt)): Deploy during thorough security assessments or when initial smaller scans return promising results warranting deeper inspection. ## Summary - SecLists provides specialized directory busting wordlists in `Discovery/Web-Content/` including DirBuster, RAFT, and auto-generated combined lists. - The [`combined_directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/combined_directories.txt) file (maintained via [`.github/workflows/wordlist-updater_combined_directories.yml`](https://github.com/danielmiessler/SecLists/blob/main/.github/workflows/wordlist-updater_combined_directories.yml)) offers a comprehensive ~200,000 entry wordlist merging all directory sources. - All wordlists use simple newline-separated format compatible with gobuster, ffuf, dirsearch, DirBuster, and Nmap. - Select wordlist size based on scan scope: small (~2-3k) for stealth, medium (~12-15k) for standard testing, or large (~100k+) for exhaustive enumeration. ## Frequently Asked Questions ### What is the best SecLists wordlist for directory busting? For most penetration testing scenarios, [`Discovery/Web-Content/raft-medium-directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/raft-medium-directories.txt) or [`Discovery/Web-Content/combined_directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/combined_directories.txt) provide optimal coverage. The RAFT lists focus on real-world discovered directories, while the combined list offers exhaustive enumeration by merging multiple sources and removing duplicates through the repository's automated workflow. ### How do I update the combined directories wordlist in SecLists? The [`Discovery/Web-Content/combined_directories.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/combined_directories.txt) file updates automatically through the GitHub Actions workflow defined in [`.github/workflows/wordlist-updater_combined_directories.yml`](https://github.com/danielmiessler/SecLists/blob/main/.github/workflows/wordlist-updater_combined_directories.yml). Users cloning the repository receive the latest version by running `git pull`, as the workflow regenerates the combined file whenever source lists change. ### Can I use SecLists with Burp Suite for directory enumeration? Yes. Burp Suite's Intruder tool can load any SecLists wordlist by selecting `Payloads > Load` and choosing files from `Discovery/Web-Content/`. Configure the payload position in your target URL path, then load [`DirBuster-2007_directory-list-2.3-small.txt`](https://github.com/danielmiessler/SecLists/blob/main/DirBuster-2007_directory-list-2.3-small.txt) or other lists to perform automated directory discovery within the Burp interface. ### What is the difference between RAFT and DirBuster wordlists? The DirBuster lists originate from the classic OWASP DirBuster project and contain comprehensive theoretical directory names. The RAFT lists derive from actual directory enumeration against real websites, offering empirically-validated paths. RAFT lists typically yield higher hit rates against modern web applications, while DirBuster lists provide broader theoretical coverage.