ALalessandroberna·Jul 4, 2026
Now you might want to open a pr like this one: https://github.com/danielmiessler/SecLists/pull/155
In Hackers shoveled snow for company, were rewarded with network admin accessdanielmiessler
SecLists
PHP2013–2026
danielmiessler / SecLists
SecLists
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
35Distinct people
35Mentions
1Explicit recommenders
74.7KGitHub stars
What to know before exploring
What it is
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
This reminds me of [0] where they maintain composite lists of frequently used passwords. Also in the repo is probably my favorite pull request ever [1]. [0]…
fbdab103 used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year35 dated mentions
Observed mentions: 2013-03-22 10:13:16 UTC to 2026-07-04 14:06:09 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 3 | 2 | 1 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 7 | 5 | 2 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 5 | 2 | 3 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
35 sourcesYou could ask for your password to be removed from the list: https://github.com/danielmiessler/SecLists/pull/155
In Why Bcrypt Can Be Unsafe for Password Hashing?check out the lists in this repo
https://github.com/danielmiessler/SecLists/blob/master/Disco...
I combined a few of the most interesting lists from here into one and never miss an attack now
In I use zip bombs to protect my serverSome bots scan using giant lists of subdomains, e.g. https://github.com/danielmiessler/SecLists/tree/master/Disco.... Your subdomain may be on that giant combined_subdomains list, or perhaps some other lists that other tools use.
In Ask HN: How did the internet discover my subdomain?Mine too.
Takes me back to when my password was leaked:
https://github.com/danielmiessler/SecLists/pull/155
In Every V4 UUIDThanks for this, just the sort of primer I was looking for.
(I was wondering why the name seemed familiar, then realized... they also are the person who put together a bunch of password lists[1] that are incredibly useful.)
[1] https://github.com/danielmiessler/SecLists/
In Vimium – The Hacker's BrowserSecLists is the security tester's companion
2 points · Open discussionBe sure to create a pr to remove your ssn from this list.
Also your passwords: https://github.com/danielmiessler/SecLists/pull/155
In Releasing everyone's SSN and the hacks used to acquire themThis reminds me of [0] where they maintain composite lists of frequently used passwords. Also in the repo is probably my favorite pull request ever [1].
[0] https://github.com/danielmiessler/SecLists
[1] https://github.com/danielmiessler/SecLists/pull/155
In DarkBeam leaks billions of email and password combinations> First, where do I find the most popular one million 12-character passwords that use A-Z/a-z/0-9?
A good starting place is
https://github.com/danielmiessler/SecLists/tree/master/Passw...
> Second, the top 1M of 6/7/8 character passwords have a statistically higher probably of being the correct password than the top 1M of 62^12 because their distribution function as a percentage of possible instances is narrower.
Not how this works. This would only be true if you were picking passwords randomly out of all possible ones and the attacker knew how long the password. For example, "password" is a more common password than "cat" is (both are terrible of course). It doesn't matter that "password" is longer than "cat".
If you knew how many characters long the password was it might be a different story. But you don't have that information. 012345
Read the rest
being a larger percentage of 6 character passwords than "password" of 8 character passwords means nothing if you don't know what length the password is. After all, 100% of passwords "af64nh8" are "af64nh8", but that means nothing unless you know the password you are attacking falls into that class.
Remove my password from lists so hackers won't be able to hack me (2017)
62 points · Open discussionNot a full security guide, but if you haven't seen this before it's useful to have...
https://github.com/danielmiessler/SecLists/blob/master/Fuzzi...
In DuckDuckGo \u202Ejust pick which size list you want to disallow: https://github.com/danielmiessler/SecLists/tree/master/Passw...
In Gift card gang extracts cash from 100k inboxes dailyShowing the 15 most recent of 35 sources. Enable JavaScript to search and browse every indexed mention.