# How to Use SecLists with Burp Suite: Complete Integration Guide

> Easily integrate danielmiessler/SecLists with Burp Suite. Load UTF-8 wordlists to automate directory enumeration, credential stuffing, and vulnerability fuzzing for enhanced security testing.

- Repository: [Daniel Miessler 🛡️/SecLists](https://github.com/danielmiessler/SecLists)
- Tags: how-to-guide
- Published: 2026-03-03

---

**Clone the danielmiessler/SecLists repository and load its UTF-8 wordlists directly into Burp Suite Intruder, Scanner, or Turbo Intruder via the "Load from file" dialog to automate directory enumeration, credential stuffing, and vulnerability fuzzing.**

SecLists is the industry-standard collection of security testing wordlists maintained by Daniel Miessler. Learning how to use SecLists with Burp Suite allows penetration testers to leverage curated payloads for brute-force attacks without formatting conversion. This guide provides exact file paths from the repository and step-by-step loading procedures for Burp's core testing tools.


## Clone and Prepare SecLists

Start by downloading the repository to your local attack machine. The files are plain text with one entry per line, making them immediately compatible with Burp Suite's payload loaders.

```bash
git clone --depth 1 https://github.com/danielmiessler/SecLists.git

```

Alternatively, download the archive directly:

```bash
wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecLists.zip && unzip SecLists.zip

```

The repository organizes wordlists into functional directories. For Burp Suite testing, the most frequently accessed paths include:

- `Discovery/Web-Content/` – Directory and file name lists for content discovery
- `Passwords/Common-Credentials/` – Real-world password dumps for credential attacks
- `Usernames/` – Username collections for enumeration
- `Fuzzing/` – XSS, SQLi, and command injection payloads


## Loading SecLists into Burp Suite Intruder

**Burp Intruder** automates customized attacks by inserting payload strings into HTTP requests. To load SecLists:

1. Navigate to **Intruder → Payloads**.
2. Set **Payload type** to **"Simple list"**.
3. Click **Load from file…** and select your chosen SecLists file.
4. Configure **Payload encoding** options (e.g., URL-encode special characters for path traversal).
5. Define **Grep-Match** rules to filter responses indicating success.

### Directory Brute-Forcing Example

Target the hidden endpoint `http://example.com/[INJECT]` to discover administrative interfaces:

1. In **Intruder → Positions**, highlight the directory segment and click **Add §**.
2. Under **Payloads**, load [`Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt).
3. Set **Payload encoding** to URL-encode the forward slash if needed.
4. Start the attack. Burp iterates through entries like `admin`, `login`, and `dashboard`, flagging HTTP 200 responses.

### Password Spraying Example

Test a login form against common credentials without triggering account lockouts:

1. Capture the login POST request in **Repeater**: `username=admin&password=INJECT`.
2. Send to **Intruder** and mark the `INJECT` position.
3. Load [`Passwords/Common-Credentials/xato-net-10-million-passwords.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/Common-Credentials/xato-net-10-million-passwords.txt) as the payload source.
4. Launch the attack and monitor the **Status** and **Length** columns for successful authentication indicators.


## Configuring Burp Scanner with Custom Payloads

**Burp Scanner** can leverage SecLists for custom insertion point testing during automated audits:

1. Go to **Scanner → Auditing → Custom payloads**.
2. Click **Add**, then select **File**.
3. Navigate to your SecLists file (e.g., [`Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt) for cross-site scripting detection).
4. Enable **"Use custom payloads in scanning"** to include these strings during vulnerability detection passes.

This integration allows Scanner to test for specific vulnerabilities using community-curated payloads rather than default dictionaries.


## Advanced Usage with Turbo Intruder

**Turbo Intruder**, a Burp extension for high-speed HTTP attacks, accepts SecLists via Python scripts. This method streams large wordlists efficiently without loading the entire file into Burp's UI memory.

### Python Script Integration

Create a script that references the absolute path to your SecLists file:

```python

# turbo_intruder.py

def queueRequests(target, wordlist):
    # Stream passwords from SecLists

    file_path = "/home/user/SecLists/Passwords/Common-Credentials/xato-net-10-million-passwords.txt"
    
    for line in open(file_path):
        payload = line.strip()
        body = f"username=admin&password={payload}"
        request = f"""POST /login HTTP/1.1
Host: {target.host}
Content-Type: application/x-www-form-urlencoded
Content-Length: {len(body)}

{body}"""
        target.queue(request)

def handleResponse(req, interesting):
    if b"Welcome" in req.response:
        table.add(req)

```

Load this script into the Turbo Intruder extension interface. The script reads [`xato-net-10-million-passwords.txt`](https://github.com/danielmiessler/SecLists/blob/main/xato-net-10-million-passwords.txt) line-by-line, injecting each password into the request body while maintaining minimal memory footprint.


## Essential SecLists Files for Burp Suite Testing

The following files represent high-value resources specifically optimized for Burp Suite workflows:

| File Path | Description | Primary Use Case |
|-----------|-------------|------------------|
| [`Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt) | Priority-ordered directory names (medium size) | Content discovery via Intruder |
| [`Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt) | Exhaustive directory list | Thorough endpoint mapping |
| [`Passwords/Common-Credentials/xato-net-10-million-passwords.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/Common-Credentials/xato-net-10-million-passwords.txt) | 10 million real-world passwords | Password spraying attacks |
| [`Usernames/xato-net-10-million-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/xato-net-10-million-usernames.txt) | 10 million username variants | Username enumeration |
| [`Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt) | Context-aware XSS payloads | Reflected XSS detection |
| [`Fuzzing/command-injection-commix.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/command-injection-commix.txt) | Command injection strings | OS command vulnerability testing |
| [`Fuzzing/special-chars.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/special-chars.txt) | Special character sets | Parameter fuzzing and WAF testing |


## Summary

- **SecLists** provides ready-to-use wordlists in `Discovery/`, `Passwords/`, `Usernames/`, and `Fuzzing/` directories that require no preprocessing for Burp Suite.
- Use **Intruder → Payloads → Simple list → Load from file** to execute brute-force attacks against directories, files, or authentication endpoints.
- Configure **Scanner → Auditing → Custom payloads** to incorporate SecLists into automated vulnerability detection.
- For high-performance testing, stream SecLists files through **Turbo Intruder** Python scripts to avoid UI memory constraints.
- Key files like [`DirBuster-2007_directory-list-2.3-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/DirBuster-2007_directory-list-2.3-medium.txt) and [`xato-net-10-million-passwords.txt`](https://github.com/danielmiessler/SecLists/blob/main/xato-net-10-million-passwords.txt) cover the majority of web application penetration testing scenarios.


## Frequently Asked Questions

### Can I use SecLists with Burp Suite Professional and Community Edition?

Yes. Both editions support loading external wordlists via Intruder. However, Burp Community Edition has rate limiting on Intruder attacks (throttled speed), while Professional allows unlimited high-speed automation. The file loading mechanism remains identical in both versions.

### How do I handle very large SecLists files without crashing Burp Suite?

For files exceeding several million lines (such as [`xato-net-10-million-passwords.txt`](https://github.com/danielmiessler/SecLists/blob/main/xato-net-10-million-passwords.txt)), use the **Turbo Intruder** extension instead of the native Intruder. Turbo Intruder streams files from disk line-by-line rather than loading the entire list into memory, preventing heap exhaustion errors in Burp's Java environment.

### Which SecLists directory should I use for API endpoint discovery?

Use `Discovery/Web-Content/` for traditional path brute-forcing, but specifically look for `Discovery/Web-Content/api/` subdirectories if available, or utilize [`Fuzzing/special-chars.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/special-chars.txt) combined with `Discovery/Web-Content/` lists to test for API versioning patterns (e.g., `/v1/`, `/api/v2/`). The `raft-` prefixed files in `Discovery/Web-Content/` are particularly effective for REST API enumeration.

### Do I need to modify SecLists files before loading them into Burp?

No modification is necessary. All SecLists files are plain UTF-8 text with one entry per line, which matches Burp Suite's expected format. Simply ensure you select the appropriate **Payload encoding** options in Burp (such as URL-encoding) if your target application requires special character handling for paths or parameters.