How to Use SecLists for Directory Busting: A Complete Guide with Examples

To use SecLists for directory busting, clone the danielmiessler/SecLists repository and supply wordlist files from Discovery/Web-Content/ (such as combined_directories.txt or raft-medium-directories.txt) to enumeration tools like gobuster, ffuf, or dirsearch via the -w flag.

SecLists is a curated collection of security testing wordlists maintained by Daniel Miessler. Learning how to use SecLists for directory busting allows security professionals to discover hidden endpoints, administrative panels, and configuration files on web servers. The repository's Discovery/Web-Content directory contains plaintext wordlists specifically optimized for HTTP directory enumeration.

What Makes SecLists Ideal for Directory Enumeration

SecLists provides several advantages over generic wordlists. Each list contains newline-separated relative paths (e.g., admin, api/v1, robots.txt) that tools automatically append to target URLs. The repository offers breadth and depth, ranging from ~2,000 entry lists for quick scans to ~200,000 entries for exhaustive enumeration. Community-driven updates ensure the lists include newly discovered paths, while the simple text format guarantees compatibility with any HTTP directory enumeration utility.

Core Directory Wordlists in SecLists

The Discovery/Web-Content/ directory contains the primary wordlists for directory busting.

DirBuster Lists

The classic DirBuster wordlists remain the industry standard for directory enumeration:

• Discovery/Web-Content/DirBuster-2007_directory-list-2.3-small.txt (~2,000 entries): Fast, low-noise scans against responsive targets
• Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt (~12,000 entries): Balanced coverage for most penetration testing scenarios
• Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt (~100,000 entries): Deep, exhaustive scans when time permits

RAFT Directory Lists

Derived from real-world site analysis, the RAFT lists offer focused alternatives:

• Discovery/Web-Content/raft-small-directories.txt (~3,000 entries): Small, targeted set based on actual discovered directories
• Discovery/Web-Content/raft-medium-directories.txt (~15,000 entries): Comprehensive medium-size compilation

Combined Directories

The file Discovery/Web-Content/combined_directories.txt (~200,000 entries) serves as a unified "one-stop" wordlist. This file is automatically generated by the GitHub Actions workflow defined in .github/workflows/wordlist-updater_combined_directories.yml, which concatenates individual DirBuster and RAFT lists while removing duplicates.

How to Use SecLists for Directory Busting: Command Examples

Below are concrete implementations using popular security tools with SecLists wordlists.

gobuster

gobuster remains one of the fastest directory busting tools. Use the dir mode with the -w flag to specify your SecLists path:

gobuster dir \
  -u https://target.example.com \
  -w /path/to/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt \
  -t 50 \
  -x php,html,aspx \
  -o gobuster-results.txt

The -t 50 flag sets 50 concurrent threads, while -x appends file extensions to each directory entry.

ffuf

ffuf uses the FUZZ placeholder to mark injection points:

ffuf -u https://target.example.com/FUZZ \
  -w /path/to/SecLists/Discovery/Web-Content/raft-small-directories.txt \
  -mc 200,204,301,302,403 \
  -e .php,.html \
  -o ffuf-results.json

The -mc flag filters for specific HTTP status codes, reducing noise from 404 responses.

dirsearch

For Python-based workflows, dirsearch accepts SecLists directly:

python3 dirsearch.py \
  -u https://target.example.com \
  -w /path/to/SecLists/Discovery/Web-Content/combined_directories.txt \
  --exclude-status 404,401 \
  -e php,html,js \
  -t 30 \
  -o dirsearch-output.txt

Using combined_directories.txt provides comprehensive coverage while --exclude-status filters out authentication and not-found responses.

Nmap http-enum

The Nmap Scripting Engine can leverage SecLists via the http-enum script:

nmap -p80,443 --script http-enum \
  --script-args http-enum.maxpathlen=10,http-enum.dirlist=/path/to/SecLists/Discovery/Web-Content/raft-medium-directories.txt \
  target.example.com

This integrates directory busting into broader network scanning workflows without requiring separate tool installation.

DirBuster (GUI/CLI)

If you prefer the original DirBuster tool, load any of the DirBuster-2007_directory-list-*.txt files into the Wordlist field. The GUI automatically iterates through entries, prepending the target URL to each path in the list.

Selecting the Optimal Wordlist Size

Choose your wordlist based on time constraints and target sensitivity:

• Small lists (DirBuster-2007_directory-list-2.3-small.txt or raft-small-directories.txt): Use for quick validation checks or when targeting high-performance production servers where request volume must remain low.
• Medium lists (DirBuster-2007_directory-list-2.3-medium.txt or raft-medium-directories.txt): Ideal for standard penetration tests, offering the best balance between coverage and scan duration.
• Large lists (combined_directories.txt or DirBuster-2007_directory-list-2.3-big.txt): Deploy during thorough security assessments or when initial smaller scans return promising results warranting deeper inspection.

Summary

• SecLists provides specialized directory busting wordlists in Discovery/Web-Content/ including DirBuster, RAFT, and auto-generated combined lists.
• The combined_directories.txt file (maintained via .github/workflows/wordlist-updater_combined_directories.yml) offers a comprehensive ~200,000 entry wordlist merging all directory sources.
• All wordlists use simple newline-separated format compatible with gobuster, ffuf, dirsearch, DirBuster, and Nmap.
• Select wordlist size based on scan scope: small (~2-3k) for stealth, medium (~12-15k) for standard testing, or large (~100k+) for exhaustive enumeration.

Frequently Asked Questions

What is the best SecLists wordlist for directory busting?

For most penetration testing scenarios, Discovery/Web-Content/raft-medium-directories.txt or Discovery/Web-Content/combined_directories.txt provide optimal coverage. The RAFT lists focus on real-world discovered directories, while the combined list offers exhaustive enumeration by merging multiple sources and removing duplicates through the repository's automated workflow.

How do I update the combined directories wordlist in SecLists?

The Discovery/Web-Content/combined_directories.txt file updates automatically through the GitHub Actions workflow defined in .github/workflows/wordlist-updater_combined_directories.yml. Users cloning the repository receive the latest version by running git pull, as the workflow regenerates the combined file whenever source lists change.

Can I use SecLists with Burp Suite for directory enumeration?

Yes. Burp Suite's Intruder tool can load any SecLists wordlist by selecting Payloads > Load and choosing files from Discovery/Web-Content/. Configure the payload position in your target URL path, then load DirBuster-2007_directory-list-2.3-small.txt or other lists to perform automated directory discovery within the Burp interface.

What is the difference between RAFT and DirBuster wordlists?

The DirBuster lists originate from the classic OWASP DirBuster project and contain comprehensive theoretical directory names. The RAFT lists derive from actual directory enumeration against real websites, offering empirically-validated paths. RAFT lists typically yield higher hit rates against modern web applications, while DirBuster lists provide broader theoretical coverage.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}