How to Use SecLists with Burp Suite: Complete Integration Guide

Clone the danielmiessler/SecLists repository and load its UTF-8 wordlists directly into Burp Suite Intruder, Scanner, or Turbo Intruder via the "Load from file" dialog to automate directory enumeration, credential stuffing, and vulnerability fuzzing.

SecLists is the industry-standard collection of security testing wordlists maintained by Daniel Miessler. Learning how to use SecLists with Burp Suite allows penetration testers to leverage curated payloads for brute-force attacks without formatting conversion. This guide provides exact file paths from the repository and step-by-step loading procedures for Burp's core testing tools.

Clone and Prepare SecLists

Start by downloading the repository to your local attack machine. The files are plain text with one entry per line, making them immediately compatible with Burp Suite's payload loaders.

git clone --depth 1 https://github.com/danielmiessler/SecLists.git

Alternatively, download the archive directly:

wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecLists.zip && unzip SecLists.zip

The repository organizes wordlists into functional directories. For Burp Suite testing, the most frequently accessed paths include:

• Discovery/Web-Content/ – Directory and file name lists for content discovery
• Passwords/Common-Credentials/ – Real-world password dumps for credential attacks
• Usernames/ – Username collections for enumeration
• Fuzzing/ – XSS, SQLi, and command injection payloads

Loading SecLists into Burp Suite Intruder

Burp Intruder automates customized attacks by inserting payload strings into HTTP requests. To load SecLists:

1. Navigate to Intruder → Payloads.
2. Set Payload type to "Simple list".
3. Click Load from file… and select your chosen SecLists file.
4. Configure Payload encoding options (e.g., URL-encode special characters for path traversal).
5. Define Grep-Match rules to filter responses indicating success.

Directory Brute-Forcing Example

Target the hidden endpoint http://example.com/[INJECT] to discover administrative interfaces:

1. In Intruder → Positions, highlight the directory segment and click Add §.
2. Under Payloads, load Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt.
3. Set Payload encoding to URL-encode the forward slash if needed.
4. Start the attack. Burp iterates through entries like admin, login, and dashboard, flagging HTTP 200 responses.

Password Spraying Example

Test a login form against common credentials without triggering account lockouts:

1. Capture the login POST request in Repeater: username=admin&password=INJECT.
2. Send to Intruder and mark the INJECT position.
3. Load Passwords/Common-Credentials/xato-net-10-million-passwords.txt as the payload source.
4. Launch the attack and monitor the Status and Length columns for successful authentication indicators.

Configuring Burp Scanner with Custom Payloads

Burp Scanner can leverage SecLists for custom insertion point testing during automated audits:

1. Go to Scanner → Auditing → Custom payloads.
2. Click Add, then select File.
3. Navigate to your SecLists file (e.g., Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt for cross-site scripting detection).
4. Enable "Use custom payloads in scanning" to include these strings during vulnerability detection passes.

This integration allows Scanner to test for specific vulnerabilities using community-curated payloads rather than default dictionaries.

Advanced Usage with Turbo Intruder

Turbo Intruder, a Burp extension for high-speed HTTP attacks, accepts SecLists via Python scripts. This method streams large wordlists efficiently without loading the entire file into Burp's UI memory.

Python Script Integration

Create a script that references the absolute path to your SecLists file:

# turbo_intruder.py

def queueRequests(target, wordlist):
    # Stream passwords from SecLists

    file_path = "/home/user/SecLists/Passwords/Common-Credentials/xato-net-10-million-passwords.txt"
    
    for line in open(file_path):
        payload = line.strip()
        body = f"username=admin&password={payload}"
        request = f"""POST /login HTTP/1.1
Host: {target.host}
Content-Type: application/x-www-form-urlencoded
Content-Length: {len(body)}

{body}"""
        target.queue(request)

def handleResponse(req, interesting):
    if b"Welcome" in req.response:
        table.add(req)

Load this script into the Turbo Intruder extension interface. The script reads xato-net-10-million-passwords.txt line-by-line, injecting each password into the request body while maintaining minimal memory footprint.

Essential SecLists Files for Burp Suite Testing

The following files represent high-value resources specifically optimized for Burp Suite workflows:

File Path	Description	Primary Use Case
Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt	Priority-ordered directory names (medium size)	Content discovery via Intruder
Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt	Exhaustive directory list	Thorough endpoint mapping
Passwords/Common-Credentials/xato-net-10-million-passwords.txt	10 million real-world passwords	Password spraying attacks
Usernames/xato-net-10-million-usernames.txt	10 million username variants	Username enumeration
Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt	Context-aware XSS payloads	Reflected XSS detection
Fuzzing/command-injection-commix.txt	Command injection strings	OS command vulnerability testing
Fuzzing/special-chars.txt	Special character sets	Parameter fuzzing and WAF testing

Summary

• SecLists provides ready-to-use wordlists in Discovery/, Passwords/, Usernames/, and Fuzzing/ directories that require no preprocessing for Burp Suite.
• Use Intruder → Payloads → Simple list → Load from file to execute brute-force attacks against directories, files, or authentication endpoints.
• Configure Scanner → Auditing → Custom payloads to incorporate SecLists into automated vulnerability detection.
• For high-performance testing, stream SecLists files through Turbo Intruder Python scripts to avoid UI memory constraints.
• Key files like DirBuster-2007_directory-list-2.3-medium.txt and xato-net-10-million-passwords.txt cover the majority of web application penetration testing scenarios.

Frequently Asked Questions

Can I use SecLists with Burp Suite Professional and Community Edition?

Yes. Both editions support loading external wordlists via Intruder. However, Burp Community Edition has rate limiting on Intruder attacks (throttled speed), while Professional allows unlimited high-speed automation. The file loading mechanism remains identical in both versions.

How do I handle very large SecLists files without crashing Burp Suite?

For files exceeding several million lines (such as xato-net-10-million-passwords.txt), use the Turbo Intruder extension instead of the native Intruder. Turbo Intruder streams files from disk line-by-line rather than loading the entire list into memory, preventing heap exhaustion errors in Burp's Java environment.

Which SecLists directory should I use for API endpoint discovery?

Use Discovery/Web-Content/ for traditional path brute-forcing, but specifically look for Discovery/Web-Content/api/ subdirectories if available, or utilize Fuzzing/special-chars.txt combined with Discovery/Web-Content/ lists to test for API versioning patterns (e.g., /v1/, /api/v2/). The raft- prefixed files in Discovery/Web-Content/ are particularly effective for REST API enumeration.

Do I need to modify SecLists files before loading them into Burp?

No modification is necessary. All SecLists files are plain UTF-8 text with one entry per line, which matches Burp Suite's expected format. Simply ensure you select the appropriate Payload encoding options in Burp (such as URL-encoding) if your target application requires special character handling for paths or parameters.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}