Param Miner

param-miner

When to Use

• Need to discover hidden query parameters
• Testing APIs for undocumented parameters
• Looking for debug or admin parameters
• User mentions parameter fuzzing or discovery
• Testing for parameter pollution vulnerabilities
• Finding hidden functionality in web applications

Quick Start

Discover parameters with Arjun:

arjun -u https://example.com/api/users

Fast parameter discovery with x8:

x8 -u "https://example.com/" -w params.txt

Step-by-Step Process

Step 1: Choose the Right Tool

Tool Selection Guide:

Step 2: Arjun - Basic Parameter Discovery

Single URL Scan:

# Basic GET parameter discovery
arjun -u https://example.com/api/endpoint

# Specify HTTP method
arjun -u https://example.com/api/endpoint -m POST

# JSON body parameters
arjun -u https://example.com/api/endpoint -m JSON

# XML body parameters
arjun -u https://example.com/api/endpoint -m XML

Multiple URLs:

# From file
arjun -i urls.txt

# Multiple URLs inline
arjun -u https://example.com/api/v1 -u https://example.com/api/v2

Custom Wordlist:

# Use custom parameter wordlist
arjun -u https://example.com/api -w custom_params.txt

# Combine with default wordlist
arjun -u https://example.com/api -w custom_params.txt --include

Step 3: Arjun - Advanced Options

With Authentication:

# Add headers
arjun -u https://example.com/api --headers "Authorization: Bearer token123"

# Add cookies
arjun -u https://example.com/api --headers "Cookie: session=abc123"

# Multiple headers
arjun -u https://example.com/api --headers "Auth: token" "X-Custom: value"

Output Options:

# JSON output
arjun -u https://example.com/api -oJ output.json

# Text output
arjun -u https://example.com/api -oT output.txt

# Burp Suite format
arjun -u https://example.com/api -oB output.xml

Rate Limiting:

# Delay between requests (seconds)
arjun -u https://example.com/api -d 2

# Timeout per request
arjun -u https://example.com/api -t 10

# Number of threads
arjun -u https://example.com/api --threads 5

Import from Burp:

# Import Burp Suite exported requests
arjun -i burp_export.xml --import-burp

Step 4: x8 - Basic Parameter Discovery

Query Parameter Discovery:

# Basic scan
x8 -u "https://example.com/" -w params.txt

# With existing parameters
x8 -u "https://example.com/?id=1" -w params.txt

# Custom injection point
x8 -u "https://example.com/?%s" -w params.txt

Body Parameter Discovery:

# POST with URL-encoded body
x8 -u "https://example.com/" -X POST -w params.txt

# POST with JSON body
x8 -u "https://example.com/" -X POST -b '{"x":{%s}}' -w params.txt

# Custom body template
x8 -u "https://example.com/" -X POST -b 'data=%s' -w params.txt

Header Discovery:

# Discover hidden headers
x8 -u "https://example.com" --headers -w headers.txt

# Target specific header value
x8 -u "https://example.com" --headers -H "Cookie: %s" -w params.txt

# X-Forwarded-For variations
x8 -u "https://example.com" --headers -H "X-Forwarded-For: %s" -w ips.txt

Step 5: x8 - Advanced Options

Multiple URLs:

# Parallel URL checking
x8 -u "https://example1.com/" "https://example2.com/" -W 0 -w params.txt

# From file
x8 -u urls.txt -w params.txt

Custom Templates:

# Array parameter format
x8 -u "https://example.com/" --param-template "user[%k]=%v" -w params.txt

# Nested JSON
x8 -u "https://example.com/" -b '{"data":{"%k":"%v"}}' -w params.txt

Request File:

# Use raw request file
x8 -r request.txt -w params.txt --proto https --port 443

# With proxy
x8 -r request.txt -w params.txt -x http://127.0.0.1:8080

Output Options:

# Standard output
x8 -u "https://example.com/" -w params.txt -o results.txt

# JSON output
x8 -u "https://example.com/" -w params.txt -O json -o results.json

# URL format
x8 -u "https://example.com/" -w params.txt -O url -o results.txt

Performance Tuning:

# Concurrency per URL
x8 -u "https://example.com/" -w params.txt -c 5

# Delay between requests (ms)
x8 -u "https://example.com/" -w params.txt -d 100

# Request timeout
x8 -u "https://example.com/" -w params.txt --timeout 30

Step 6: Parameter Verification

x8 Verification:

# Verify found parameters
x8 -u "https://example.com/" -w params.txt --verify

# Replay through proxy
x8 -u "https://example.com/" -w params.txt --replay-proxy http://127.0.0.1:8080

# All found params in one replay request
x8 -u "https://example.com/" -w params.txt --replay-proxy http://127.0.0.1:8080 --replay-once

Recursion:

# Recursive parameter discovery
x8 -u "https://example.com/" -w params.txt --recursion-depth 2

Step 7: Common Parameter Patterns

Custom Parameter Values:

# x8 custom parameters (admin, debug, etc.)
x8 -u "https://example.com/" -w params.txt --custom-parameters "admin debug test dev"

# Custom values to test
x8 -u "https://example.com/" -w params.txt --custom-values "true false 1 0 yes no"

Built-in Special Parameters:

Default custom parameters checked by x8:

• admin, bot, captcha, debug
• disable, encryption, env, show
• sso, test, waf

Step 8: Burp Suite Integration

x8 with Burp (via Custom Send To):

1. Install "Custom Send To" extension in Burp
2. Configure command:

x8 --progress-bar-len 20 -c 3 -r %R -w /path/to/wordlist --proto %T --port %P

3. Right-click request > Send to > x8

Export Results to Burp:

# Arjun Burp export
arjun -u https://example.com/api -oB burp_import.xml

# Import in Burp: Target > Import from file

Parameter Wordlists

Recommended Wordlists

Download Locations:

# SecLists
git clone https://github.com/danielmiessler/SecLists

# samlists
git clone https://github.com/the-xentropy/samlists

# Arjun built-in
# Located at: arjun/db/

Custom Wordlist Creation

# Extract params from JS files
cat js_files/*.js | grep -oE '[a-zA-Z_][a-zA-Z0-9_]*=' | sed 's/=//' | sort -u > custom_params.txt

# Combine wordlists
cat wordlist1.txt wordlist2.txt | sort -u > combined.txt

Examples

Example 1: Basic GET Parameter Discovery

Scenario: Find hidden parameters on an API endpoint

Command:

arjun -u https://api.acme.com/v1/users -m GET

Output:

[*] Probing the target for stability
[*] Analysing HTTP response for anomalies
[*] Analysing HTTP response for potential parameter names
[*] Logicforcing: 50-60 requests
[+] Valid parameters found: admin, debug, verbose, fields, expand

Example 2: POST JSON Parameter Discovery

Scenario: Find hidden JSON body parameters

Command:

x8 -u "https://api.acme.com/v1/login" -X POST -b '{"username":"test","password":"test",%s}' -w params.txt -c 3

Output:

[+] https://api.acme.com/v1/login
    Method: POST
    Parameters found:
    - admin (reflected)
    - mfa_bypass (response changed)
    - debug (response code changed)

Example 3: Header Discovery

Scenario: Find hidden headers that affect application behavior

Command:

x8 -u "https://acme.com/admin" --headers -w SecLists/Discovery/Web-Content/BurpSuite-ParamMiner/lowercase-headers -c 5

Output:

[+] https://acme.com/admin
    Headers found:
    - x-forwarded-for (response changed)
    - x-real-ip (response changed)
    - x-debug (response code: 200 -> 500)

Example 4: Multi-URL Parallel Scan

Scenario: Scan multiple endpoints simultaneously

Command:

x8 -u urls.txt -W 0 -w params.txt -c 2 -O json -o results.json

Output (results.json):

{
  "https://acme.com/api/v1/users": {
    "method": "GET",
    "parameters": ["admin", "include_deleted", "verbose"]
  },
  "https://acme.com/api/v1/orders": {
    "method": "GET",
    "parameters": ["status", "debug"]
  }
}

Error Handling

Tool Reference

Arjun Flags

x8 Flags

Best Practices

1. Start with defaults - Arjun's built-in wordlist catches common params
2. Use appropriate method - Match HTTP method to endpoint behavior
3. Respect rate limits - Add delays for production systems
4. Verify findings - Use --verify to confirm real parameters
5. Try multiple methods - Some params only work with POST/PUT
6. Check headers too - Hidden headers can bypass security
7. Combine tools - Use Arjun for quick scan, x8 for thorough check
8. Document findings - Export results for reporting

References

• Arjun GitHub
• Arjun Wiki
• x8 GitHub
• x8 Documentation
• SecLists Parameters
• Param Miner (Burp)