Skip to content
HackIndex logo

HackIndex

HTTP Parameter Crawling and Discovery

4 min read Mar 30, 2026

Parameter discovery finds GET and POST parameters the application accepts but doesn't expose in visible forms or links. Hidden parameters are a direct path to injection vulnerabilities, IDOR, and business logic issues. Run this after content discovery so you have a full list of endpoints to target. Results feed into SQL injection detection, SSRF detection, and IDOR testing.

Arjun — Parameter Discovery

Arjun is the go-to tool for parameter discovery. It tests large wordlists efficiently by grouping parameters and comparing responses:

┌──(kali㉿kali)-[~]
└─$ arjun -u http://$TARGET_IP:$PORT/endpoint 
[+] Parameters found: id, user, token, debug
Explain command
-u Specifies the target URL to scan for hidden HTTP parameters.
http://$TARGET_IP:$PORT/endpoint Target URL with variable host IP, port, and endpoint path.
┌──(kali㉿kali)-[~]
└─$ arjun -u http://$TARGET_IP:$PORT/endpoint -m POST
Explain command
-u Specifies the target URL to scan for parameters.
http://$TARGET_IP:$PORT/endpoint Target URL with variable host IP and port to the endpoint.
-m Specifies the HTTP method to use for requests.
POST Uses HTTP POST method for parameter discovery.
┌──(kali㉿kali)-[~]
└─$ arjun -u http://$TARGET_IP:$PORT/endpoint -m JSON
Explain command
-u Specifies the target URL to scan for hidden parameters.
http://$TARGET_IP:$PORT/endpoint Target URL with variable host IP and port to probe.
-m Sets the request method/format for parameter discovery.
JSON Sends parameters in JSON format in the request body.

Run against multiple endpoints at once by providing a file:

┌──(kali㉿kali)-[~]
└─$ arjun -i endpoints.txt -o arjun_results.json
Explain command
-i endpoints.txt Input file containing list of endpoints to scan.
-o arjun_results.json Save discovered parameters output to specified JSON file.

For authenticated endpoints, add the session cookie:

┌──(kali㉿kali)-[~]
└─$ arjun -u http://$TARGET_IP:$PORT/api/endpoint -H "Cookie: session=REPLACE_ME" -m GET
Explain command
-u Target URL to scan for hidden HTTP parameters.
http://$TARGET_IP:$PORT/api/endpoint Target host IP, port, and API endpoint path to fuzz.
-H Specify a custom HTTP header to include in requests.
"Cookie: session=REPLACE_ME" Session cookie header value used for authenticated requests.
-m Specify the HTTP method to use for parameter discovery.
GET Use HTTP GET method when sending parameter fuzzing requests.

x8 — Parameter Bruteforce

x8 is faster than Arjun for high-volume parameter discovery and handles response differences more granularly:

┌──(kali㉿kali)-[~]
└─$ x8 -u http://$TARGET_IP:$PORT/endpoint -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
Explain command
-u http://$TARGET_IP:$PORT/endpoint Target URL to fuzz for hidden HTTP parameters.
-w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt Wordlist of parameter names to use during fuzzing.
┌──(kali㉿kali)-[~]
└─$ x8 -u http://$TARGET_IP:$PORT/endpoint -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -m POST
Explain command
-u http://$TARGET_IP:$PORT/endpoint Target URL to probe for hidden HTTP parameters.
-w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt Wordlist file containing parameter names to fuzz with.
-m POST Use HTTP POST method for parameter discovery requests.

ffuf for Manual Parameter Fuzzing

When you already know a parameter exists and want to test values, ffuf is more flexible than dedicated parameter discovery tools:

┌──(kali㉿kali)-[~]
└─$ ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://$TARGET_IP:$PORT/page?FUZZ=test -mc 200,204,301,302,307,401,403 -fs 1234
Explain command
-w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt Wordlist file containing parameter names to fuzz.
-u http://$TARGET_IP:$PORT/page?FUZZ=test Target URL with FUZZ keyword marking the injection point.
$TARGET_IP:$PORT Variable placeholders for the target host IP and port.
-mc 200,204,301,302,307,401,403 Match only responses with these HTTP status codes.
-fs 1234 Filter out responses with a body size of 1234 bytes.
┌──(kali㉿kali)-[~]
└─$ ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://$TARGET_IP:$PORT/page -X POST -d "FUZZ=test" -H "Content-Type: application/x-www-form-urlencoded" -mc 200,204,301,302,307,401,403 -fs 1234
Explain command
-w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt Wordlist path used for fuzzing parameter names.
-u http://$TARGET_IP:$PORT/page Target URL with host and port placeholders.
-X POST Use HTTP POST method for requests.
-d "FUZZ=test" POST body data with FUZZ keyword as the parameter name placeholder.
-H "Content-Type: application/x-www-form-urlencoded" Set Content-Type header for URL-encoded form data.
-mc 200,204,301,302,307,401,403 Match only responses with these HTTP status codes.
-fs 1234 Filter out responses with a body size of 1234 bytes.

JavaScript Source Mining

JavaScript files often contain API endpoints and parameter names not visible in HTML. Extract them before running parameter discovery:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/app.js | grep -oP '(?<=[?&])[a-zA-Z_][a-zA-Z0-9_]*(?==)' | sort -u
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections, skipping certificate verification.
http://$TARGET_IP:$PORT/app.js Target URL with variable host and port to fetch app.js.
-oP Output only matched text using Perl-compatible regex.
(?<=[?&])[a-zA-Z_][a-zA-Z0-9_]*(?==) PCRE lookaround to extract URL query parameter names.
-u Output only unique lines, suppressing duplicates.
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/app.js | grep -oE '"[a-z_][a-z0-9_]{2,}"\s*:' | tr -d '":' | sort -u
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure TLS connections by skipping certificate verification.
http://$TARGET_IP:$PORT/app.js Target URL with variable host and port to fetch the JS file.
-oE Enables extended regex and prints only the matching part of each line.
"[a-z_][a-z0-9_]{2,}"\s*: Regex pattern to extract lowercase JSON-style key names.
-d Specifies characters to delete; removes quotes and colons from output.
'":' Set of characters (double-quote, colon) to strip via tr.
-u Outputs only unique sorted lines, removing duplicates.

Discovered parameters are the starting point for injection testing. Take any parameter that accepts user input and test it through SQL injection detection, SSTI detection, and SSRF detection.

References