bruteforce-database

Bruteforce Database - Wordlists for Ethical Security Testing

CI License: MIT

A collection of wordlists for security testing, penetration testing, and password analysis.

Note: For authorized testing only. Only use on systems you own or have permission to test.

Quick Start

# Clone the repository
git clone https://github.com/duyet/bruteforce-database.git
cd bruteforce-database

# Example: Test SSH login (authorized testing only!)
hydra -L usernames.txt -P 1000000-password-seclists.txt ssh://target.example.com

# Example: Web directory brute-forcing
gobuster dir -u https://example.com -w forced-browsing/all.txt

# Example: Subdomain enumeration
ffuf -u https://FUZZ.example.com -w subdomains-10000.txt

What’s Inside

Stats

Use Cases

I need to… Use this wordlist Why?
Test common passwords 1000000-password-seclists.txt Most common passwords from breach data
Test password policy 8-more-passwords.txt Filtered for length, complexity requirements
Enumerate user accounts usernames.txt 400K+ common US usernames
Find hidden directories forced-browsing/all.txt Comprehensive web path discovery
Discover subdomains subdomains-10000.txt 10K most common subdomain names
Test against massive dataset 2151220-passwords.txt 2.1M password compilation
Generate wordlist for JtR uniqpass_v16_password.txt Optimized for John the Ripper
Test keyboard patterns cain.txt Includes common patterns from Cain & Abel

Available Wordlists

Password Dictionaries

General Purpose

Filtered Sets

Specialized

Tool-Specific

Usernames & Identities

Geographic Data

Infrastructure Testing

Forced Browsing / Directory Discovery

forced-browsing/ directory contains specialized wordlists for web application testing:

Categorized by File Type

forced-browsing/cat/ - Organized by file category:

Context-Based Paths

forced-browsing/context/ - Organized by context:

Usage Example:

# Scan for admin panels
gobuster dir -u https://target.com -w forced-browsing/context/admin.txt

# Look for config files
ffuf -u https://target.com/FUZZ -w forced-browsing/cat/Conf/conf.txt

# Comprehensive directory scan
dirsearch -u https://target.com -w forced-browsing/all.txt

Usage Examples

Password Cracking

# John the Ripper
john --wordlist=2151220-passwords.txt hashes.txt

# Hashcat (MD5)
hashcat -m 0 -a 0 hashes.txt 1000000-password-seclists.txt

# Hydra (SSH brute force)
hydra -l admin -P 8-more-passwords.txt ssh://192.168.1.100

Web Application Testing

# Directory discovery with gobuster
gobuster dir -u https://example.com -w forced-browsing/all.txt -t 50

# File discovery with specific extensions
gobuster dir -u https://example.com -w forced-browsing/all-extensionless.txt -x php,html,txt

# Fast fuzzing with ffuf
ffuf -u https://example.com/FUZZ -w forced-browsing/context/admin.txt -mc 200,301,302

Subdomain Enumeration

# Sublist3r
sublist3r -d example.com -w subdomains-10000.txt

# ffuf for subdomain fuzzing
ffuf -u https://FUZZ.example.com -w subdomains-10000.txt -mc 200

# gobuster DNS mode
gobuster dns -d example.com -w subdomains-10000.txt

Account Enumeration

# Test for valid usernames (authorized only!)
./enum4linux -U target.com -w usernames.txt

# Check username availability
curl https://api.example.com/check-username -d "username=FUZZ" -w usernames.txt

Decision Guide: Which Wordlist?

For Password Testing

Quick test (< 1 minute):

Standard test (5-10 minutes):

Comprehensive test (30+ minutes):

Policy-specific testing:

For Web Testing

Quick scan:

Standard scan:

Comprehensive scan:

File-specific:

Tools That Work With These Wordlists

Password Cracking

Web Testing

Subdomain Discovery

Automation & Quality

This repository includes automation tools:

Validation Tools

# Validate all wordlists
python3 scripts/validate.py

# Validate specific file
python3 scripts/validate.py --file passwords.txt

# Deduplicate wordlists
python3 scripts/deduplicate.py passwords.txt

# Deduplicate all
python3 scripts/deduplicate.py --all

CI/CD Pipeline

Every commit and pull request is automatically:

See .github/workflows/validate.yml

Manifest

The manifest.json file contains metadata for every wordlist:

Generated automatically on every commit.

Contributing

We welcome contributions! See CONTRIBUTING.md for detailed guidelines.

Quick Contribution Checklist

Running Validation Locally

# Before submitting PR
python3 scripts/validate.py
python3 scripts/deduplicate.py --all

Ethics & Responsible Use

IMPORTANT: These wordlists are for authorized security testing only.

Acceptable Use

Unacceptable Use

By using these wordlists, you agree to use them responsibly and legally.

See CLAUDE.md for our full philosophy on ethical use.

Project Philosophy

Read CLAUDE.md for our principles:

Contributors

Thank you to everyone who has contributed to this project:

Want to contribute? See CONTRIBUTING.md!

License

This project is licensed under the MIT License.

You are free to:

Requirements:

Support This Project

If you find this project useful:

Changelog

See CHANGELOG.md for version history and updates.

“Quality is not an act, it’s a habit.” - Aristotle

Made with ❤️ by the security community, for the security community.

This site is open source. Improve this page.