# HTTP Parameter Crawling and Discovery

- **URL:** https://hackindex.io/services/web/enumeration/parameter-crawling
- **Path:** HTTP/HTTPS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/web/enumeration.md)
- **Published:** 2026-01-23
- **Updated:** 2026-03-30

Parameter discovery finds GET and POST parameters the application accepts but doesn't expose in visible forms or links. Hidden parameters are a direct path to injection vulnerabilities, IDOR, and business logic issues. Run this after [content discovery](https://hackindex.io/services/web/enumeration/content-discovery) and [web crawling](https://hackindex.io/services/web/enumeration/web-crawling) so you have a full list of endpoints to target. Results feed into [SQL injection detection](https://hackindex.io/services/web/vulnerability-discovery/sql-injection-detection), [SSRF detection](https://hackindex.io/services/web/vulnerability-discovery/ssrf-detection), and [IDOR testing](https://hackindex.io/services/web/vulnerability-discovery/idor-testing-by-parameter-tampering).

Tools for HTTP parameter discovery and when to use each:

- **Arjun**: best default choice, groups parameters for efficient testing across GET, POST, and JSON
- **x8**: faster than Arjun for large wordlists, more granular response comparison
- **ffuf**: manual parameter value fuzzing when you already know a parameter exists
- **JavaScript mining**: extract parameter names from JS source before running any tool

## Arjun: Parameter Discovery

Arjun is the go-to tool for parameter discovery. It tests large wordlists efficiently by grouping parameters and comparing responses:

```bash
arjun -u http://$TARGET_IP:$PORT/endpoint
# [+] Parameters found: id, user, token, debug
```

```bash
arjun -u http://$TARGET_IP:$PORT/endpoint -m POST
```

```bash
arjun -u http://$TARGET_IP:$PORT/endpoint -m JSON
```

Run against multiple endpoints at once by providing a file:

```bash
arjun -i endpoints.txt -o arjun_results.json
```

For authenticated endpoints, add the session cookie:

```bash
arjun -u http://$TARGET_IP:$PORT/api/endpoint -H "Cookie: session=REPLACE_ME" -m GET
```

## x8: Parameter Bruteforce

x8 is faster than Arjun for high-volume parameter discovery and handles response differences more granularly:

```bash
x8 -u http://$TARGET_IP:$PORT/endpoint -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
```

```bash
x8 -u http://$TARGET_IP:$PORT/endpoint -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -X POST
```

## ffuf for Manual Parameter Fuzzing

When you already know a parameter exists and want to test values, ffuf is more flexible than dedicated parameter discovery tools:

```bash
ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://$TARGET_IP:$PORT/page?FUZZ=test -mc 200,204,301,302,307,401,403 -fs 1234
```

```bash
ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://$TARGET_IP:$PORT/page -X POST -d "FUZZ=test" -H "Content-Type: application/x-www-form-urlencoded" -mc 200,204,301,302,307,401,403 -fs 1234
```

## JavaScript Source Mining

JavaScript files often contain API endpoints and parameter names not visible in HTML. Extract them before running parameter discovery:

```bash
curl -sk http://$TARGET_IP:$PORT/app.js | grep -oP '(?<=[?&])[a-zA-Z_][a-zA-Z0-9_]*(?==)' | sort -u
```

```bash
curl -sk http://$TARGET_IP:$PORT/app.js | grep -oE '"[a-z_][a-z0-9_]{2,}"\s*:' | tr -d '":' | sort -u
```

Discovered parameters are the starting point for injection testing. Take any parameter that accepts user input and test it through [SQL injection detection](https://hackindex.io/services/web/vulnerability-discovery/sql-injection-detection), [SSTI detection](https://hackindex.io/services/web/vulnerability-discovery/ssti-detection), and [SSRF detection](https://hackindex.io/services/web/vulnerability-discovery/ssrf-detection).

## References

- [Arjun](https://github.com/s0md3v/Arjun) - HTTP parameter discovery tool supporting GET, POST, JSON, and XML
- [x8](https://github.com/Sh1Yo/x8) - Hidden HTTP parameter discovery tool with response comparison
- [ffuf](https://github.com/ffuf/ffuf) - Parameter value fuzzing and filtering options