Does fallparams need katana to crawl?

No. fallparams ships its own crawler, turned on with -crawl and bounded by -depth and -crawl-duration. If you already collected URLs with katana or gau, skip crawling and pass the list with -url.

Can fallparams find parameters in JavaScript-heavy apps?

Yes. Enable -headless so fallparams drives a real browser and captures parameters that appear only after JavaScript runs, not only those present in static HTML.

Can fallparams run without sending traffic to the target?

Yes. Point -dir at a directory of stored requests and responses, or pass a saved request with -request, and fallparams extracts parameters offline without touching the live host.

How is fallparams different from paramspider or arjun?

fallparams crawls the live target and builds a wordlist from what the app exposes. paramspider mines web archives passively. arjun brute-forces from a built-in list. Use fallparams when you want names sourced from the running app.

Updated Jul 14, 2026

Discovery

Harvest app-specific parameters into a fuzzing wordlist

Crawl pages, harvest potential parameters, write a custom wordlist.

Build an app-specific parameter wordlist Catch JS-rendered parameters Mine stored requests offline

overview

What fallparams does

fallparams takes a URL, URL file, or stored-requests directory and writes a parameter wordlist file plus a results folder. Enable -crawl to walk pages, -depth to bound the crawl, and -headless when names only appear after JavaScript.

Reach for it when a generic parameter list wastes fuzzing budget. Names come from the running app, so the next stage hits realistic keys instead of dictionary noise.

It discovers names only. It does not test them. Pair the wordlist with x8 or ffuf. For archive-sourced names without live traffic, prefer paramspider; for brute-force from a built-in list, prefer arjun.

source github.com/ImAyrix/fallparams

use cases

Where fallparams fits

Build an app-specific parameter wordlist

Crawl a target so the resulting wordlist holds the parameter names the application itself exposes, instead of a generic list full of misses.

Catch JS-rendered parameters

Run with a headless browser so parameters that appear only after JavaScript executes get captured alongside the static ones.

Mine stored requests offline

Point it at a directory of saved requests and responses to extract parameters without sending any traffic to the target.

Seed a parameter fuzzer

Feed the generated wordlist into x8 or ffuf so the fuzzing stage tests realistic names for injection, IDOR, and hidden functionality.

reference

fallparams inputs and flags

18 inputs

Name	Type	Flag	Description
url	STRING	-url	Input URL to analyze for parameters.
urls	FILE	-url	Input URLs file for processing many targets.
crawl	BOOLEAN	-crawl	Crawl pages to extract their parameters.
depth	STRING	-depth	Maximum depth to crawl (default 2).
headless	BOOLEAN	-headless	Discover parameters with a headless browser.
dir	FOLDER	-dir	Stored requests/responses directory for offline analysis.
thread	STRING	-thread	Number of threads (default 1).
proxy	STRING	-proxy	Proxy URL (SOCKS5 or HTTP), e.g. http://127.0.0.1:8080.

Showing key inputs. fallparams exposes 18 inputs in total.

Full flag reference (18 inputs)

Name	Type	Flag	Description
dir	FOLDER	-dir	Stored requests/responses files directory path (offline)
url	STRING	-url	Input URL
body	STRING	-body	POST data
urls	FILE	-url	Input URLs file
crawl	BOOLEAN	-crawl	Crawl pages to extract their parameters
delay	STRING	-delay	Request delay between each request in seconds
depth	STRING	-depth	maximum depth to crawl (default 2)
proxy	STRING	-proxy	Proxy URL (SOCKS5 or HTTP). For example: http://127.0.0.1:8080 or socks5://127.0.0.1:8080
header	STRING	-header	Header "Name: Value", separated by colon. Multiple -H flags are accepted.
method	STRING	-method	HTTP method to use (default "GET")
silent	BOOLEAN	-silent	Disables the banner and prints output to the command line.
thread	STRING	-thread	Number Of Threads [Number] (default 1)
request	FILE	-request	File containing the raw http request
headless	BOOLEAN	-headless	Discover parameters with headless browser
max-length	STRING	-max-length	Maximum length of words (default 30)
min-length	STRING	-min-length	Minimum length of words
crawl-duration	STRING	-crawl-duration	maximum duration to crawl the target
disable-update-check	BOOLEAN	-disable-update-check	Disable automatic fallparams update check

example

Run fallparams

fallparams · command

# crawl a target two levels deep, including JS-rendered pages, and build a parameter wordlistfallparams -url https://example.com -crawl -depth 2 -headless

sample output

idpageqredirectlangreftokencsrfcallback…  (custom parameter wordlist written for the real run behind this page)

guidance

Choosing fallparams

Mine a live app for real parameter names before fuzzing. Follow with x8 or ffuf. Prefer paramspider for archive-only mining, arjun for dictionary brute-force.

paramspider

Mines parameters from web archives. Passive and archive-sourced; fallparams crawls live.

x8

Tests for hidden parameters. Run it after fallparams on the generated wordlist.

arjun

Brute-forces parameters from a built-in list. fallparams builds a target-specific list to feed it.

faq

fallparams questions

A file and a folder. The file is a custom parameter wordlist built from names found on the target, ready to feed a fuzzer like x8 or ffuf.

Run fallparams yourself

A URL feeds fallparams, which crawls it into a parameter wordlist that x8 then tests, writing the confirmed parameters as output.

Open fallparams in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.