> For the complete documentation index, see [llms.txt](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/misc/wordlists-dictionaries.md).

# Wordlists and dictionaries

## Related

[Passwords & credentials](/the-pentesters-cheat-sheet/exploitation/passwords/04-passwords-credentials.md)

## Wordlists

```bash
/usr/share/wordlists/
```

## Password Lists

### rockyou

[rockyou.txt](http://downloads.skullsecurity.org/passwords/rockyou.txt.bz2)\
Compromise from 2009 from a social game and advertising website

### msf

```bash
/usr/share/metasploit-framework/data/wordlists
```

### crackstation-human-only

[crackstation-human-only](http://download.g0tmi1k.com/wordlists/large/crackstation-human-only.txt.gz)\
Real human passwords leaked from various website databases.

### m3g0tr0n\_Passwords\_WordList\_CLEANED

[m3g0tr0n\_Passwords\_WordList\_CLEANED](http://forums.pirate-server.com/data/m3g9tr0n_Passwords_WordList_CLEANED.zip)\
List of 122 Million Passwords

## SecLists

> SecLists is the security tester’s companion. It’s a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.\
> [GitHub - danielmiessler/SecLists](https://github.com/danielmiessler/SecLists)

Common usernames: `SecLists/Usernames/Names/names.txt`\
Common passwords: `SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt`

Search for default creds (e.g. for tomcat)

```bash
find /usr/share/seclists | grep -i tomcat`
```