{
  "slug": "parameter-discovery",
  "title": "Parameter & Input Discovery",
  "phase": "Enumeration",
  "description": "Discover hidden parameters, form fields, API arguments, and input vectors across all endpoints to maximise the attack surface for injection and logic testing.",
  "difficulty": "medium",
  "tags": [
    "enumeration",
    "parameters",
    "fuzzing",
    "input-discovery",
    "attack-surface"
  ],
  "tools": [
    "Arjun",
    "ParamSpider",
    "Burp Suite",
    "ffuf"
  ],
  "steps": [
    {
      "id": "param-01",
      "title": "Discover hidden parameters with Arjun",
      "description": "Brute-force query, POST body, and JSON parameters on discovered endpoints using Arjun's optimised wordlists.",
      "commands": [
        "arjun -u https://target.com/api/users -oJ arjun-params.json",
        "arjun -u https://target.com/search -m POST -oJ arjun-post.json",
        "arjun -u https://target.com/api/v1/items -m JSON -oJ arjun-json.json",
        "arjun -i endpoints.txt -oJ arjun-batch.json --stable"
      ],
      "notes": "Use --stable mode on targets with rate limiting. Arjun detects parameters by analysing response length and status code variations — verify findings manually before reporting."
    },
    {
      "id": "param-02",
      "title": "Scan for reflected parameters with ParamSpider",
      "description": "Mine web archives and passive sources for URLs containing query parameters, then test which parameters are reflected in responses.",
      "commands": [
        "paramspider -d target.com -o paramspider-urls.txt",
        "cat paramspider-urls.txt | sort -u | httpx -silent -mc 200 -o live-params.txt",
        "cat paramspider-urls.txt | grep -iE '(redirect|url|next|return|callback)' > redirect-params.txt"
      ],
      "notes": "ParamSpider pulls from web archives without sending requests to the target. Combine its output with Arjun for maximum coverage."
    },
    {
      "id": "param-03",
      "title": "Discover hidden parameters with Param Miner",
      "description": "Use Burp Suite's Param Miner extension to discover hidden headers, cookies, and query parameters through differential response analysis.",
      "commands": [
        "# Burp Suite > Extensions > Param Miner > right-click request > Guess params",
        "# Configure: Guess headers, Guess cookies, Guess query params",
        "# Review: Extensions > Param Miner > Output tab"
      ],
      "notes": "Param Miner excels at finding cache poisoning vectors. Pay attention to unkeyed headers and parameters that alter cached responses."
    },
    {
      "id": "param-04",
      "title": "Analyse form fields and hidden inputs",
      "description": "Extract all form fields, hidden inputs, and data attributes from HTML to identify input vectors that are not visible in the UI.",
      "commands": [
        "curl -sk https://target.com/login | grep -iE '(<input|<select|<textarea)' | grep -iE '(hidden|name=)'",
        "katana -u https://target.com -d 3 -f qurl -o katana-forms.txt",
        "nuclei -u https://target.com -t exposures/configs/ -o hidden-inputs.txt"
      ],
      "notes": "Hidden form fields often contain session tokens, CSRF tokens, role identifiers, or debug flags that can be manipulated for privilege escalation."
    },
    {
      "id": "param-05",
      "title": "Fuzz API parameters with ffuf",
      "description": "Fuzz REST API endpoints for undocumented parameters that modify application behaviour.",
      "commands": [
        "ffuf -u 'https://target.com/api/users?FUZZ=true' -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -mc 200 -o ffuf-params.json",
        "ffuf -u https://target.com/api/users -X POST -d '{\"FUZZ\":\"test\"}' -H 'Content-Type: application/json' -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -mc 200 -o ffuf-json-params.json",
        "ffuf -u 'https://target.com/api/users?id=1&FUZZ=1' -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 4242 -o ffuf-extra-params.json"
      ],
      "notes": "Filter by response size (-fs) to eliminate false positives. Look for parameters like debug, admin, test, internal, verbose, and role that alter application behaviour."
    },
    {
      "id": "param-06",
      "title": "Discover content-type manipulation vectors",
      "description": "Test how endpoints handle different Content-Type headers to find parsing differentials and bypass input validation.",
      "commands": [
        "curl -sk -X POST https://target.com/api/login -H 'Content-Type: application/json' -d '{\"user\":\"admin\",\"pass\":\"test\"}'",
        "curl -sk -X POST https://target.com/api/login -H 'Content-Type: application/xml' -d '<user>admin</user><pass>test</pass>'",
        "curl -sk -X POST https://target.com/api/login -H 'Content-Type: application/x-www-form-urlencoded' -d 'user=admin&pass=test'"
      ],
      "notes": "Many frameworks silently parse multiple content types. Switching from JSON to XML can bypass WAF rules or enable XXE injection."
    },
    {
      "id": "param-07",
      "title": "Test for HTTP parameter pollution",
      "description": "Send duplicate parameters to discover how the application handles conflicting values and find bypass opportunities.",
      "commands": [
        "curl -sk 'https://target.com/api/transfer?amount=1&amount=1000'",
        "curl -sk 'https://target.com/search?q=safe&q=<script>alert(1)</script>'",
        "curl -sk -X POST https://target.com/api/users -d 'role=user&role=admin'"
      ],
      "notes": "Different frameworks handle duplicate parameters differently — PHP takes the last value, ASP.NET concatenates them, and Flask takes the first. Test accordingly."
    }
  ],
  "references": [
    "https://github.com/s0md3v/Arjun",
    "https://github.com/devanshbatham/ParamSpider",
    "https://github.com/PortSwigger/param-miner",
    "https://github.com/ffuf/ffuf",
    "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}