// Payloads · Hidden Parameters

HTTP Hidden Parameters

HTTP Hidden Parameters

Web applications often have hidden or undocumented parameters that are not exposed in the user interface. Fuzzing can help discover these parameters, which might be vulnerable to various attacks.

Summary

Tools
Methodology
- Bruteforce Parameters
- Old Parameters
References

Tools

PortSwigger/param-miner - Burp extension to identify hidden, unlinked parameters.
s0md3v/Arjun - HTTP parameter discovery suite
Sh1Yo/x8 - Hidden parameters discovery suite
tomnomnom/waybackurls - Fetch all the URLs that the Wayback Machine knows about for a domain
devanshbatham/ParamSpider - Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing

Methodology

Bruteforce Parameters

Use wordlists of common parameters and send them, look for unexpected behavior from the backend.

x8 -u "https://example.com/" -w <wordlist>
x8 -u "https://example.com/" -X POST -w <wordlist>

Wordlist examples:

Old Parameters

Explore all the URL from your targets to find old parameters.

Browse the Wayback Machine
Look through the JS files to discover unused parameters

References

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Choose your decrypted JSON once to save access:

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.