loading
Loading content
loading
Discovery
Crawl pages, harvest potential parameters, write a custom wordlist.
overview
fallparams takes a URL, URL file, or stored-requests directory and writes a parameter wordlist file plus a results folder. Enable -crawl to walk pages, -depth to bound the crawl, and -headless when names only appear after JavaScript.
Reach for it when a generic parameter list wastes fuzzing budget. Names come from the running app, so the next stage hits realistic keys instead of dictionary noise.
It discovers names only. It does not test them. Pair the wordlist with x8 or ffuf. For archive-sourced names without live traffic, prefer paramspider; for brute-force from a built-in list, prefer arjun.
use cases
Crawl a target so the resulting wordlist holds the parameter names the application itself exposes, instead of a generic list full of misses.
Run with a headless browser so parameters that appear only after JavaScript executes get captured alongside the static ones.
Point it at a directory of saved requests and responses to extract parameters without sending any traffic to the target.
Feed the generated wordlist into x8 or ffuf so the fuzzing stage tests realistic names for injection, IDOR, and hidden functionality.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -url | Input URL to analyze for parameters. |
| urls | FILE | -url | Input URLs file for processing many targets. |
| crawl | BOOLEAN | -crawl | Crawl pages to extract their parameters. |
| depth | STRING | -depth | Maximum depth to crawl (default 2). |
| headless | BOOLEAN | -headless | Discover parameters with a headless browser. |
| dir | FOLDER | -dir | Stored requests/responses directory for offline analysis. |
| thread | STRING | -thread | Number of threads (default 1). |
| proxy | STRING | -proxy | Proxy URL (SOCKS5 or HTTP), e.g. http://127.0.0.1:8080. |
Showing key inputs. fallparams exposes 18 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| dir | FOLDER | -dir | Stored requests/responses files directory path (offline) |
| url | STRING | -url | Input URL |
| body | STRING | -body | POST data |
| urls | FILE | -url | Input URLs file |
| crawl | BOOLEAN | -crawl | Crawl pages to extract their parameters |
| delay | STRING | -delay | Request delay between each request in seconds |
| depth | STRING | -depth | maximum depth to crawl (default 2) |
| proxy | STRING | -proxy | Proxy URL (SOCKS5 or HTTP). For example: http://127.0.0.1:8080 or socks5://127.0.0.1:8080 |
| header | STRING | -header | Header "Name: Value", separated by colon. Multiple -H flags are accepted. |
| method | STRING | -method | HTTP method to use (default "GET") |
| silent | BOOLEAN | -silent | Disables the banner and prints output to the command line. |
| thread | STRING | -thread | Number Of Threads [Number] (default 1) |
| request | FILE | -request | File containing the raw http request |
| headless | BOOLEAN | -headless | Discover parameters with headless browser |
| max-length | STRING | -max-length | Maximum length of words (default 30) |
| min-length | STRING | -min-length | Minimum length of words |
| crawl-duration | STRING | -crawl-duration | maximum duration to crawl the target |
| disable-update-check | BOOLEAN | -disable-update-check | Disable automatic fallparams update check |
example
# crawl a target two levels deep, including JS-rendered pages, and build a parameter wordlistfallparams -url https://example.com -crawl -depth 2 -headlessidpageqredirectlangreftokencsrfcallback… (custom parameter wordlist written for the real run behind this page)guidance
Mine a live app for real parameter names before fuzzing. Follow with x8 or ffuf. Prefer paramspider for archive-only mining, arjun for dictionary brute-force.
Mines parameters from web archives. Passive and archive-sourced; fallparams crawls live.
Tests for hidden parameters. Run it after fallparams on the generated wordlist.
Brute-forces parameters from a built-in list. fallparams builds a target-specific list to feed it.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
Reconstruct commits from a dumped .git folder.
A URL feeds fallparams, which crawls it into a parameter wordlist that x8 then tests, writing the confirmed parameters as output.
Facts on this page come from the live Trickest tool library.