# Using SecLists with Burp Suite for Web Testing: Integration Guide

> Integrate SecLists with Burp Suite for powerful web testing. Automate directory brute-forcing, extension enumeration, and vulnerability fuzzing efficiently.

- Repository: [Daniel Miessler 🛡️/SecLists](https://github.com/danielmiessler/SecLists)
- Tags: how-to-guide
- Published: 2026-03-03

---

**Load SecLists wordlists into Burp Suite's Intruder, Scanner, or Repeater using the Runtime file payload type to automate directory brute-forcing, extension enumeration, and vulnerability fuzzing.**

SecLists, maintained by Daniel Miessler, is the industry's standard repository for curated security testing wordlists. When integrated with Burp Suite, these plain-text lists enable security professionals to conduct comprehensive web application assessments without manual payload generation.

## Setting Up SecLists for Burp Suite

Before integrating with Burp Suite, clone the repository to your local machine. The shallow clone flag ensures you download only the latest commit, saving disk space while preserving all functional wordlists.

```bash
git clone --depth 1 https://github.com/danielmiessler/SecLists.git

```

All SecLists files are plain text with one entry per line, making them immediately compatible with Burp Suite's **Runtime file** payload type. The repository organizes content into logical categories including **Discovery**, **Fuzzing**, **Passwords**, and **Usernames**, with the `Discovery/Web-Content/` and `Fuzzing/` directories being most relevant for Burp automation.

## Loading Wordlists into Burp Suite Intruder

The **Intruder** tool is the primary method for automated fuzzing with SecLists. To configure payload-based attacks:

1. Open **Intruder** → **Positions** → highlight the target insertion point in the request.
2. Navigate to **Payloads** → **Payload type** → select **Runtime file**.
3. Browse to the desired SecLists file, such as [`SecLists/Discovery/Web-Content/web-extensions.txt`](https://github.com/danielmiessler/SecLists/blob/main/SecLists/Discovery/Web-Content/web-extensions.txt) for uncommon file extensions (`.php7`, `.pht`, `.rb`).

This approach replaces the insertion point with every line from the selected wordlist. For directory enumeration, use [`SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt), which contains approximately 133,000 entries balanced for depth without overwhelming target systems.

## Configuring Burp Scanner with SecLists

Burp Suite's **Scanner** can consume SecLists for custom directory and file extension enumeration during crawl-and-audit phases:

1. Navigate to **Scanner** → **Scan configuration** → **Advanced** → **Insertion points**.
2. Under **Directories** or **File extensions**, click **Add** and select [`SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt).
3. Enable the configuration in your active scan to combine wordlist entries with Burp's native heuristics.

For URL mutation testing—such as discovering resources via trailing slashes or dot insertion—load [`SecLists/Discovery/Web-Content/web-mutations.txt`](https://github.com/danielmiessler/SecLists/blob/main/SecLists/Discovery/Web-Content/web-mutations.txt) into the scanner's URL modification settings.

## Manual Payload Testing with Burp Repeater

When testing specific vulnerabilities manually, copy payloads directly from SecLists into **Repeater**. The [`SecLists/Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt`](https://github.com/danielmiessler/SecLists/blob/main/SecLists/Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt) file contains real-world XSS vectors specifically contextualized for Burp Suite users.

At line 992, the file explicitly references Burp Proxy functionality: *"you need to inject them directly using something like Burp Proxy (http://www.portswigger.net/proxy/)"*. To test null-character bypasses:

1. Open the XSS file and locate the null-byte injection payloads.
2. Copy the vector into Repeater's request editor.
3. Ensure the editor is set to **raw** mode to preserve byte-level encoding.

## Essential SecLists Files for Web Testing

The following files in the `danielmiessler/SecLists` repository provide maximum value when integrated with Burp Suite:

- **[`Discovery/Web-Content/web-extensions.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/web-extensions.txt)** — 44 common and uncommon web file extensions ideal for Intruder-based extension brute-forcing.
- **[`Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt)** — A 133,000-entry directory list optimized for scanner integration without triggering rate limits.
- **[`Discovery/Web-Content/web-mutations.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/web-mutations.txt)** — Simple URL mutations (adding `.php`, trailing slashes) for discovering hidden resources.
- **[`Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt)** — Context-aware XSS payloads including Burp Proxy references for manual testing.
- **`Payloads/`** — Directory containing SQL injection, path traversal, and command injection payloads for targeted fuzzing campaigns.

## Optimization Strategies for Large Wordlists

Raw SecLists files can generate excessive traffic if used indiscriminately. Implement these practices to maintain testing efficiency:

- **Trim large lists** before runtime. The DirBuster "big" variant can trigger rate-limiting; filter it with `grep` or `awk` to match your target's technology stack.
- **Combine with Burp's built-in heuristics**. Enable "smart" scanning options to avoid duplicate requests when wordlist entries overlap with Burp's native discovery logic.
- **Update weekly**. Run `git pull` in your SecLists directory to receive new extensions and mutation patterns as the community contributes them.
- **Validate encodings**. Payloads containing null characters or binary data require Burp's request editor to be in **raw** mode rather than **pretty** mode to prevent corruption during transmission.

## Summary

Integrating SecLists with Burp Suite transforms manual payload generation into automated, comprehensive testing:

- Use **Runtime file** payload type in Intruder to consume any SecLists wordlist for brute-force attacks.
- Load [`DirBuster-2007_directory-list-2.3-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/DirBuster-2007_directory-list-2.3-medium.txt) into Scanner for deep directory enumeration without performance degradation.
- Reference [`XSS-With-Context-Jhaddix.txt`](https://github.com/danielmiessler/SecLists/blob/main/XSS-With-Context-Jhaddix.txt) line 992 for Burp Proxy-specific testing instructions.
- Maintain updated wordlists via `git pull` to ensure coverage of emerging file extensions and attack vectors.

## Frequently Asked Questions

### How do I load a custom wordlist into Burp Suite Intruder?

Open **Intruder** → **Payloads** → set **Payload type** to **Runtime file**, then browse to your local SecLists file (e.g., [`SecLists/Discovery/Web-Content/web-extensions.txt`](https://github.com/danielmiessler/SecLists/blob/main/SecLists/Discovery/Web-Content/web-extensions.txt)). Burp will read the file line-by-line, inserting each entry at your defined payload positions.

### Which SecLists file is best for directory enumeration in Burp Scanner?

Use [`SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt`](https://github.com/danielmiessler/SecLists/blob/main/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt). This file contains approximately 133,000 directory names—sufficient for comprehensive coverage while avoiding the request volume that triggers rate-limiting on most targets.

### Can I use SecLists with Burp Suite Community Edition?

Yes. While Community Edition limits Intruder attack speed and Scanner functionality, you can still load SecLists into Intruder using the **Runtime file** payload type and manually paste payloads from SecLists files into Repeater for testing.

### How do I prevent SecLists from overwhelming my target with requests?

Filter large lists before use with command-line tools like `grep` to create technology-specific subsets (e.g., `grep "\.php"` for PHP targets). Additionally, enable Burp's built-in rate-limiting and use the "medium" DirBuster list rather than the "big" variant to reduce request volume.