Browse / Payloads / Hidden Parameters

Hidden Parameters

4 passages of payloads and techniques.

Overview

Web applications often have hidden or undocumented parameters that are not exposed in the user interface. Fuzzing can help discover these parameters, which might be vulnerable to various attacks.

Source

Tools

PortSwigger/param-miner - Burp extension to identify hidden, unlinked parameters.
s0md3v/Arjun - HTTP parameter discovery suite
Sh1Yo/x8 - Hidden parameters discovery suite
tomnomnom/waybackurls - Fetch all the URLs that the Wayback Machine knows about for a domain
devanshbatham/ParamSpider - Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing

Source

Methodology > Bruteforce Parameters

Use wordlists of common parameters and send them, look for unexpected behavior from the backend.
```
x8 -u "https://example.com/" -w <wordlist>
x8 -u "https://example.com/" -X POST -w <wordlist>
```

Wordlist examples:

Source

Methodology > Old Parameters

Explore all the URL from your targets to find old parameters.

Browse the Wayback Machine
Look through the JS files to discover unused parameters

Source

From PayloadsAllTheThings by Swissky and contributors, used under the MIT licence. Use it only on systems you are authorised to test.