loading
Loading content
loading
Fuzzing
Passive archive miner for parameterized URLs on a domain.
overview
ParamSpider mines web archives for parameterized URLs on a --domain, keeping only query strings worth testing. It never sends a request to the live host.
Filter noise with --exclude (png,jpg,css). Set --level for nested parameters. Replace values with --placeholder (default FUZZ) so the list is fuzzer-ready. Omit --subs to include subdomains.
Use it as the passive parameter-collection stage before an injection tester. Prefer gau when you want all archived URLs; prefer x8 or Arjun to brute-force hidden params on a live endpoint.
use cases
Mine a domain's web archives for URLs with query strings, so you get a clean list of injectable endpoints without touching the target.
Leave the subdomain exclusion off so the run covers the domain and its subdomains, widening the parameter set in one pass.
Exclude URLs by extension to strip images, fonts, and scripts, keeping only the dynamic endpoints worth testing.
Use a custom placeholder so each parameter value is marked, handing an injection tester URLs that are ready to fuzz.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | --domain | Domain to mine for parameters. |
| exclude-subdomain | STRING | --subs | Exclude subdomains; omit to mine the domain and its subdomains together. |
| exclude-url-extension | STRING | --exclude | Exclude URLs with the given file extensions (e.g. png,jpg,css). |
| nested-parameters | STRING | --level | Depth for finding nested parameters (e.g. high). |
| custom-placeholder | STRING | --placeholder | Placeholder that replaces each parameter value (default FUZZ). |
Showing key inputs. paramspider exposes 5 inputs in total.
example
# mine parameterized URLs from archives, drop static assets, mark values with FUZZparamspider --domain example.com --exclude png,jpg,css,woff --level high --placeholder FUZZ[INFO] Fetching URLs for example.com from the Wayback Machine[INFO] Found 214 URLs, extracting parameters[INFO] Output saved to output/example.com.txthttps://example.com/index.php?id=FUZZhttps://example.com/search?q=FUZZ&page=FUZZhttps://api.example.com/v1/user?uid=FUZZhttps://shop.example.com/product?sku=FUZZ&ref=FUZZhttps://example.com/go?redirect=FUZZhttps://blog.example.com/post?year=FUZZ&slug=FUZZguidance
Use ParamSpider to build a parameterized URL list from archives without touching the target. It finds parameters; it does not test them. Follow with an injection fuzzer. For live-site crawling, use katana or gospider instead.
Pulls all archived URLs, not only parameterized ones. ParamSpider keeps URLs that carry query parameters.
Discovers parameters by crawling and analysis. ParamSpider sources them passively from archives.
Brute-forces hidden parameters against a live target. ParamSpider mines known ones from history.
faq
related
A fast web fuzzer written in Go.
Enumerate IIS 8.3 short filenames to recover hidden paths.
Directory and file brute forcing across many hosts.
ffuf looped over a URL list in one node.
Folder-output ffuf for a single target.
Host-header fuzzing packaged for vhost discovery.
A domain feeds ParamSpider, which mines parameterized URLs from archives and passes them to dalfox for testing before the results land as output.
Facts on this page come from the live Trickest tool library.