Parameter & Input Discovery

Enumeration MED v1.0.0 updated 2026-06-17

Discover hidden parameters, form fields, API arguments, and input vectors across all endpoints to maximise the attack surface for injection and logic testing.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/parameter-discovery

// checklist steps

param-01

Discover hidden parameters with Arjun

Brute-force query, POST body, and JSON parameters on discovered endpoints using Arjun's optimised wordlists.

arjun -u https://target.com/api/users -oJ arjun-params.json
arjun -u https://target.com/search -m POST -oJ arjun-post.json
arjun -u https://target.com/api/v1/items -m JSON -oJ arjun-json.json
arjun -i endpoints.txt -oJ arjun-batch.json --stable

Use --stable mode on targets with rate limiting. Arjun detects parameters by analysing response length and status code variations — verify findings manually before reporting.

param-02

Scan for reflected parameters with ParamSpider

Mine web archives and passive sources for URLs containing query parameters, then test which parameters are reflected in responses.

paramspider -d target.com -o paramspider-urls.txt
cat paramspider-urls.txt | sort -u | httpx -silent -mc 200 -o live-params.txt
cat paramspider-urls.txt | grep -iE '(redirect|url|next|return|callback)' > redirect-params.txt

ParamSpider pulls from web archives without sending requests to the target. Combine its output with Arjun for maximum coverage.

param-03

Discover hidden parameters with Param Miner

Use Burp Suite's Param Miner extension to discover hidden headers, cookies, and query parameters through differential response analysis.

# Burp Suite > Extensions > Param Miner > right-click request > Guess params
# Configure: Guess headers, Guess cookies, Guess query params
# Review: Extensions > Param Miner > Output tab

Param Miner excels at finding cache poisoning vectors. Pay attention to unkeyed headers and parameters that alter cached responses.

param-04

Analyse form fields and hidden inputs

Extract all form fields, hidden inputs, and data attributes from HTML to identify input vectors that are not visible in the UI.

curl -sk https://target.com/login | grep -iE '(<input|<select|<textarea)' | grep -iE '(hidden|name=)'
katana -u https://target.com -d 3 -f qurl -o katana-forms.txt
nuclei -u https://target.com -t exposures/configs/ -o hidden-inputs.txt

Hidden form fields often contain session tokens, CSRF tokens, role identifiers, or debug flags that can be manipulated for privilege escalation.

param-05

Fuzz API parameters with ffuf

Fuzz REST API endpoints for undocumented parameters that modify application behaviour.

ffuf -u 'https://target.com/api/users?FUZZ=true' -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -mc 200 -o ffuf-params.json
ffuf -u https://target.com/api/users -X POST -d '{"FUZZ":"test"}' -H 'Content-Type: application/json' -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -mc 200 -o ffuf-json-params.json
ffuf -u 'https://target.com/api/users?id=1&FUZZ=1' -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 4242 -o ffuf-extra-params.json

Filter by response size (-fs) to eliminate false positives. Look for parameters like debug, admin, test, internal, verbose, and role that alter application behaviour.

param-06

Discover content-type manipulation vectors

Test how endpoints handle different Content-Type headers to find parsing differentials and bypass input validation.

curl -sk -X POST https://target.com/api/login -H 'Content-Type: application/json' -d '{"user":"admin","pass":"test"}'
curl -sk -X POST https://target.com/api/login -H 'Content-Type: application/xml' -d '<user>admin</user><pass>test</pass>'
curl -sk -X POST https://target.com/api/login -H 'Content-Type: application/x-www-form-urlencoded' -d 'user=admin&pass=test'

Many frameworks silently parse multiple content types. Switching from JSON to XML can bypass WAF rules or enable XXE injection.

param-07

Test for HTTP parameter pollution

Send duplicate parameters to discover how the application handles conflicting values and find bypass opportunities.

curl -sk 'https://target.com/api/transfer?amount=1&amount=1000'
curl -sk 'https://target.com/search?q=safe&q=<script>alert(1)</script>'
curl -sk -X POST https://target.com/api/users -d 'role=user&role=admin'

Different frameworks handle duplicate parameters differently — PHP takes the last value, ASP.NET concatenates them, and Flask takes the first. Test accordingly.

Overview

Parameter discovery expands the attack surface by revealing input vectors that are invisible to casual browsing. Hidden parameters frequently control access levels, debug modes, and internal routing — making them high-value targets for injection and logic testing.

Methodology

Effective parameter discovery combines three approaches:

Passive harvesting — mine web archives and JavaScript for historical parameters
Active brute-forcing — use wordlists to probe for undocumented parameters
Differential analysis — detect parameters by observing response changes

What to prioritise

Parameters that modify access control (role, admin, debug, internal)
Redirect and URL parameters (redirect_uri, next, return, callback)
ID parameters susceptible to IDOR (user_id, account, order_id)
Parameters that toggle application features (beta, preview, v2)

// references

← All checklists JSON ↗