Using SecLists with Burp Suite for Web Testing: Integration Guide

Load SecLists wordlists into Burp Suite's Intruder, Scanner, or Repeater using the Runtime file payload type to automate directory brute-forcing, extension enumeration, and vulnerability fuzzing.

SecLists, maintained by Daniel Miessler, is the industry's standard repository for curated security testing wordlists. When integrated with Burp Suite, these plain-text lists enable security professionals to conduct comprehensive web application assessments without manual payload generation.

Setting Up SecLists for Burp Suite

Before integrating with Burp Suite, clone the repository to your local machine. The shallow clone flag ensures you download only the latest commit, saving disk space while preserving all functional wordlists.

git clone --depth 1 https://github.com/danielmiessler/SecLists.git

All SecLists files are plain text with one entry per line, making them immediately compatible with Burp Suite's Runtime file payload type. The repository organizes content into logical categories including Discovery, Fuzzing, Passwords, and Usernames, with the Discovery/Web-Content/ and Fuzzing/ directories being most relevant for Burp automation.

Loading Wordlists into Burp Suite Intruder

The Intruder tool is the primary method for automated fuzzing with SecLists. To configure payload-based attacks:

1. Open Intruder → Positions → highlight the target insertion point in the request.
2. Navigate to Payloads → Payload type → select Runtime file.
3. Browse to the desired SecLists file, such as SecLists/Discovery/Web-Content/web-extensions.txt for uncommon file extensions (.php7, .pht, .rb).

This approach replaces the insertion point with every line from the selected wordlist. For directory enumeration, use SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt, which contains approximately 133,000 entries balanced for depth without overwhelming target systems.

Configuring Burp Scanner with SecLists

Burp Suite's Scanner can consume SecLists for custom directory and file extension enumeration during crawl-and-audit phases:

1. Navigate to Scanner → Scan configuration → Advanced → Insertion points.
2. Under Directories or File extensions, click Add and select SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt.
3. Enable the configuration in your active scan to combine wordlist entries with Burp's native heuristics.

For URL mutation testing—such as discovering resources via trailing slashes or dot insertion—load SecLists/Discovery/Web-Content/web-mutations.txt into the scanner's URL modification settings.

Manual Payload Testing with Burp Repeater

When testing specific vulnerabilities manually, copy payloads directly from SecLists into Repeater. The SecLists/Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt file contains real-world XSS vectors specifically contextualized for Burp Suite users.

At line 992, the file explicitly references Burp Proxy functionality: "you need to inject them directly using something like Burp Proxy (http://www.portswigger.net/proxy/)". To test null-character bypasses:

1. Open the XSS file and locate the null-byte injection payloads.
2. Copy the vector into Repeater's request editor.
3. Ensure the editor is set to raw mode to preserve byte-level encoding.

Essential SecLists Files for Web Testing

The following files in the danielmiessler/SecLists repository provide maximum value when integrated with Burp Suite:

• Discovery/Web-Content/web-extensions.txt — 44 common and uncommon web file extensions ideal for Intruder-based extension brute-forcing.
• Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt — A 133,000-entry directory list optimized for scanner integration without triggering rate limits.
• Discovery/Web-Content/web-mutations.txt — Simple URL mutations (adding .php, trailing slashes) for discovering hidden resources.
• Fuzzing/XSS/human-friendly/XSS-With-Context-Jhaddix.txt — Context-aware XSS payloads including Burp Proxy references for manual testing.
• Payloads/ — Directory containing SQL injection, path traversal, and command injection payloads for targeted fuzzing campaigns.

Optimization Strategies for Large Wordlists

Raw SecLists files can generate excessive traffic if used indiscriminately. Implement these practices to maintain testing efficiency:

• Trim large lists before runtime. The DirBuster "big" variant can trigger rate-limiting; filter it with grep or awk to match your target's technology stack.
• Combine with Burp's built-in heuristics. Enable "smart" scanning options to avoid duplicate requests when wordlist entries overlap with Burp's native discovery logic.
• Update weekly. Run git pull in your SecLists directory to receive new extensions and mutation patterns as the community contributes them.
• Validate encodings. Payloads containing null characters or binary data require Burp's request editor to be in raw mode rather than pretty mode to prevent corruption during transmission.

Summary

Integrating SecLists with Burp Suite transforms manual payload generation into automated, comprehensive testing:

• Use Runtime file payload type in Intruder to consume any SecLists wordlist for brute-force attacks.
• Load DirBuster-2007_directory-list-2.3-medium.txt into Scanner for deep directory enumeration without performance degradation.
• Reference XSS-With-Context-Jhaddix.txt line 992 for Burp Proxy-specific testing instructions.
• Maintain updated wordlists via git pull to ensure coverage of emerging file extensions and attack vectors.

Frequently Asked Questions

How do I load a custom wordlist into Burp Suite Intruder?

Open Intruder → Payloads → set Payload type to Runtime file, then browse to your local SecLists file (e.g., SecLists/Discovery/Web-Content/web-extensions.txt). Burp will read the file line-by-line, inserting each entry at your defined payload positions.

Which SecLists file is best for directory enumeration in Burp Scanner?

Use SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt. This file contains approximately 133,000 directory names—sufficient for comprehensive coverage while avoiding the request volume that triggers rate-limiting on most targets.

Can I use SecLists with Burp Suite Community Edition?

Yes. While Community Edition limits Intruder attack speed and Scanner functionality, you can still load SecLists into Intruder using the Runtime file payload type and manually paste payloads from SecLists files into Repeater for testing.

How do I prevent SecLists from overwhelming my target with requests?

Filter large lists before use with command-line tools like grep to create technology-specific subsets (e.g., grep "\.php" for PHP targets). Additionally, enable Burp's built-in rate-limiting and use the "medium" DirBuster list rather than the "big" variant to reduce request volume.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}