Fuzzing
Mine parameterized URLs from archives without host traffic
paramspider is an archive-mining tool that digs URLs with parameters out of the dark corners of web archives for a given domain, gleaning archived GET-parameter requests to feed bug hunting, fuzzing, and further probing.
installgit clone https://github.com/devanshbatham/paramspiderpip install .
Python · MIT license
overview
What paramspider does
ParamSpider mines web archives for parameterized URLs on a --domain, keeping only query strings worth testing. It never sends a request to the live host.
Filter noise with --exclude (png,jpg,css). Set --level for nested parameters. Replace values with --placeholder (default FUZZ) so the list is fuzzer-ready. Omit --subs to include subdomains.
Use it as the passive parameter-collection stage before an injection tester. Prefer gau when you want all archived URLs; prefer x8 or Arjun to brute-force hidden params on a live endpoint.
use cases
Where paramspider fits
Build a parameterized URL list passively
Mine a domain's web archives for URLs with query strings, so you get a clean list of injectable endpoints without touching the target.
Include subdomain parameters
Leave the subdomain exclusion off so the run covers the domain and its subdomains, widening the parameter set in one pass.
Drop static asset noise
Exclude URLs by extension to strip images, fonts, and scripts, keeping only the dynamic endpoints worth testing.
Seed a fuzzer with placeholders
Use a custom placeholder so each parameter value is marked, handing an injection tester URLs that are ready to fuzz.
reference
paramspider inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | --domain | Domain to mine for parameters. |
| exclude-subdomain | STRING | --subs | Exclude subdomains; omit to mine the domain and its subdomains together. |
| exclude-url-extension | STRING | --exclude | Exclude URLs with the given file extensions (e.g. png,jpg,css). |
| nested-parameters | STRING | --level | Depth for finding nested parameters (e.g. high). |
| custom-placeholder | STRING | --placeholder | Placeholder that replaces each parameter value (default FUZZ). |
Showing key inputs. paramspider exposes 5 inputs in total.
example
Run paramspider
# mine parameterized URLs from archives, drop static assets, mark values with FUZZ
paramspider --domain example.com --exclude png,jpg,css,woff --level high --placeholder FUZZ[INFO] Fetching URLs for example.com from the Wayback Machine
[INFO] Found 214 URLs, extracting parameters
[INFO] Output saved to output/example.com.txt
https://example.com/index.php?id=FUZZ
https://example.com/search?q=FUZZ&page=FUZZ
https://api.example.com/v1/user?uid=FUZZ
https://shop.example.com/product?sku=FUZZ&ref=FUZZ
https://example.com/go?redirect=FUZZ
https://blog.example.com/post?year=FUZZ&slug=FUZZguidance
Choosing paramspider
Use ParamSpider to build a parameterized URL list from archives without touching the target. It finds parameters; it does not test them. Follow with an injection fuzzer. For live-site crawling, use katana or gospider instead.
gau
Pulls all archived URLs, not only parameterized ones. ParamSpider keeps URLs that carry query parameters.
fallparams
Discovers parameters by crawling and analysis. ParamSpider sources them passively from archives.
x8
Brute-forces hidden parameters against a live target. ParamSpider mines known ones from history.
faq
paramspider questions
related
More Fuzzing tools
ffuf
A fast web fuzzer written in Go.
shortscan
Enumerate IIS 8.3 short filenames to recover hidden paths.
crithit
Directory and file brute forcing across many hosts.
ffuf-virtual-hosts
Host-header fuzzing packaged for vhost discovery.
medusa
Recursive HTTP directory and file fuzzer.
x8
Hidden parameter discovery by response comparison.
Run paramspider yourself
A domain feeds ParamSpider, which mines parameterized URLs from archives and passes them to dalfox for testing before the results land as output.
Facts on this page come from the live Trickest tool library.