SecLists Username Lists for Brute Force Attacks: A Comprehensive Guide

SecLists provides curated, community-maintained plain-text wordlists stored in the Usernames/ directory, ranging from 18-entry shortlists to 10-million-entry datasets, formatted for immediate consumption by brute-force tools like Hydra, Medusa, and Burp Intruder.

The danielmiessler/SecLists repository serves as the security tester's companion for credential enumeration and brute force testing. Its dedicated Usernames/ directory contains specialized wordlists that eliminate the need to generate custom lists from scratch. Whether performing rapid credential spraying or exhaustive dictionary attacks, these SecLists username lists for brute force attacks provide the foundational data required for effective penetration testing.

Understanding the Usernames Directory Structure

Located at Usernames/ in the repository root, this subdirectory organizes all username-related wordlists by scope and source. According to the Usernames/README.md, the directory maintains strict formatting standards: each file contains one username per line with no extra delimiters or comments, though empty lines may appear at file ends. This consistency ensures immediate compatibility with automation tools without preprocessing scripts.

Key Username Wordlists for Penetration Testing

Top Username Shortlist for Rapid Enumeration

The Usernames/top-usernames-shortlist.txt file contains the 18 most common usernames found in real-world breaches. This compact list serves as the optimal starting point for "first-pass" attacks when testing time is limited. Security professionals use this file for quick credential spraying against SSH, RDP, and web authentication portals.

Vendor-Specific Default Accounts

For targeted testing against enterprise software, Usernames/sap-default-usernames.txt contains default service accounts specific to SAP systems, including entries like DDIC and SAP*. These vendor-specific lists allow testers to target known default configurations rather than guessing generic terms.

Community-Sourced Collections

The Usernames/cirt-default-usernames.txt file aggregates over 800 entries collected from the CIRT project. This mid-sized collection strikes a balance between the shortlist and massive datasets, providing comprehensive coverage for general brute force scenarios without the performance overhead of multi-gigabyte files.

Large-Scale Public Datasets

For exhaustive testing campaigns, Usernames/xato-net-10-million-usernames.txt delivers ten million usernames harvested from public sources. This massive dataset supports thorough dictionary attacks against high-value targets where credential guessing requires maximum breadth.

Practical Implementation Examples

Hydra Command-Line Attacks

The THC-Hydra tool accepts SecLists files directly via the -L flag. This example combines the short username list with the RockYou password list against an SSH target:

hydra -L Usernames/top-usernames-shortlist.txt -P Passwords/rockyou.txt ssh://192.168.1.10

Python Automation with Paramiko

When building custom brute force scripts, load vendor-specific lists using standard file I/O. This Python example targets SAP default accounts:

from pathlib import Path
import paramiko

user_file = Path('Usernames/sap-default-usernames.txt')
passwd_file = Path('Passwords/common.txt')

users = user_file.read_text().splitlines()
passwords = passwd_file.read_text().splitlines()

host = '10.0.0.5'
for user in users:
    for pwd in passwords:
        try:
            ssh = paramiko.SSHClient()
            ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
            ssh.connect(host, username=user, password=pwd, timeout=3)
            print(f'Success: {user}/{pwd}')
            ssh.close()
            break
        except Exception:
            pass

Burp Suite Intruder Integration

For web application testing, Burp Intruder consumes the massive public datasets efficiently:

1. Navigate to Intruder → Positions and set the target URL.
2. Select Payloads → Payload Sets and choose File as the type.
3. Load Usernames/xato-net-10-million-usernames.txt for the username position.
4. Add a second payload set pointing to Passwords/10k-most-common.txt.
5. Execute the attack to iterate over the Cartesian product of credentials.

Summary

• SecLists organizes username wordlists under Usernames/ with consistent one-entry-per-line formatting.
• Short lists (top-usernames-shortlist.txt) provide 18 common entries for rapid initial testing.
• Vendor lists (sap-default-usernames.txt) contain platform-specific defaults like SAP service accounts.
• Massive datasets (xato-net-10-million-usernames.txt) support exhaustive brute force campaigns.
• All files work immediately with Hydra (-L), Medusa (-U), Burp Intruder, and custom scripts without preprocessing.

Frequently Asked Questions

What is the fastest way to start testing with SecLists usernames?

Clone the repository and use Usernames/top-usernames-shortlist.txt with Hydra. This 18-entry list requires minimal bandwidth and provides immediate results against common default accounts.

Are the SecLists username files formatted for specific tools?

No, the files use a universal plain-text format with one username per line. This standard structure works with any tool accepting line-delimited input, including Hydra, Medusa, Burp Suite, and custom Python scripts.

Which SecLists username file should I use for SAP systems?

Use Usernames/sap-default-usernames.txt, which contains specific SAP default accounts like DDIC and SAP*. This vendor-specific list targets known SAP service accounts rather than generic usernames.

How large is the biggest username list in SecLists?

The Usernames/xato-net-10-million-usernames.txt file contains ten million entries harvested from public sources. This dataset supports comprehensive brute force attacks but requires significant memory and time resources compared to smaller targeted lists.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}