Fuzzing
Discover hidden parameters by response diff
Hidden parameter discovery by response comparison.
overview
What x8 does
x8 probes a known --url with a --wordlist of candidate parameter names. It compares responses against a learned baseline and keeps names that change status, length, or body.
Aim at the query string by default, or supply --body for POST and PUT. --max caps parameters per request; --delay paces rate-limited apps; --strict and --verify cut false positives.
Point --url and --wordlist at the node; it writes FOLDER and FILE of confirmed parameter names. Hand those names to ffuf or an injection scanner for value testing. Use --strict and --verify when catch-all pages would otherwise inflate hits.
source github.com/Sh1Yo/x8
use cases
Where x8 fits
Discover undocumented query parameters
Brute-force parameter names against a live endpoint and keep only the ones that change the response, exposing inputs the application never advertised.
Find hidden body and header parameters
Switch the injection point to the request body or headers to surface parameters that only take effect on POST, PUT, or in specific headers.
Feed an injection-testing stage
Hand the discovered parameters to a fuzzer or injection scanner so testing targets real, server-honored inputs instead of guessed ones.
Cut false positives with verification
Use strict comparison and the verify pass so reported parameters are confirmed against a baseline, not artifacts of a noisy page.
reference
x8 inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| max | STRING | --max | Change the maximum number of parameters per request. (default is <= 256 for query, 64 for headers and 512 for body) |
| url | STRING | --url | You can add a custom injection point with %s. Multiple values are supported: https://url1 http://url2 |
| body | STRING | --body | Example body: '{"x":{%s}}' |
| http | STRING | --http | HTTP version. Supported versions: --http 1.1, --http 2 |
| port | STRING | --port | Port to use with request file |
| test | BOOLEAN | --test | Prints request and response |
| delay | STRING | --delay | Delay between requests in milliseconds [default: 0] |
Showing key inputs. x8 exposes 46 inputs in total.
Full flag reference (46 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| max | STRING | --max | Change the maximum number of parameters per request. (default is <= 256 for query, 64 for headers and 512 for body) |
| url | STRING | --url | You can add a custom injection point with %s. Multiple values are supported: https://url1 http://url2 |
| body | STRING | --body | Example body: '{"x":{%s}}' |
| http | STRING | --http | HTTP version. Supported versions: --http 1.1, --http 2 |
| port | STRING | --port | Port to use with request file |
| test | BOOLEAN | --test | Prints request and response |
| delay | STRING | --delay | Delay between requests in milliseconds [default: 0] |
| force | BOOLEAN | --force | Force searching for parameters on pages > 25MB. Remove an error in case there's 1 |
| proto | STRING | --proto | Protocol to use with request file (default is "https") |
| proxy | STRING | --proxy | Proxy |
| encode | BOOLEAN | --encode | Encodes query or body before making a request, i.e & -> %26, = -> %3D |
| invert | BOOLEAN | --invert | By default, parameters are sent within the body only in case PUT or POST methods |
| joiner | STRING | --joiner | How to join parameter templates. Example: --joiner '&'. Default: urlencoded - '&', json - ', ', header values - '; ' |
| method | STRING | --method | Multiple values are supported: -X GET POST |
| strict | BOOLEAN | --strict | Only report parameters that have changed the different parts of a page |
| verify | BOOLEAN | --verify | Verify found parameters. |
| headers | STRING | -H | Example: 'one:one' 'two:two' |
| request | FILE | --request | The file with the raw http request |
| timeout | STRING | --timeout | HTTP request timeout in seconds. [default: 15] |
| verbose | STRING | --verbose | Verbose level 0/1/2 [default: 1] |
| workers | STRING | --workers | The number of concurrent url checks. [default: 1] |
| split-by | STRING | --split-by | Split the request into lines by the provided sequence. By default splits by \r, \n and \r\n |
| url-list | FILE | --url | You can add a custom injection point with %s. Multiple values are supported: https://url1 http://url2 |
| wordlist | FILE | --wordlist | -w, --wordlist <wordlist> |
| data-type | STRING | --data-type | -t, --data-type <data-type> |
| concurrency | STRING | -c | The number of concurrent requests per url [default: 1] |
| replay-once | BOOLEAN | --replay-once | If a replay proxy is specified, send all found parameters within one request. |
| check-binary | BOOLEAN | --check-binary | Check the body of responses with binary content types |
| remove-empty | BOOLEAN | --remove-empty | Skip writing to file outputs of url:method pairs without found parameters |
| replay-proxy | STRING | --replay-proxy | Request target with every found parameter via the replay proxy at the end. |
| custom-values | STRING | --custom-values | Values for custom parameters (default is "1 0 false off null true yes no") |
| mimic-browser | BOOLEAN | --mimic-browser | Add default headers that browsers usually set. |
| output-format | STRING | --output-format | standart, json, url, request [default: standart] |
| disable-colors | BOOLEAN | --disable-colors | Disable colors |
| learn-requests | STRING | --learn-requests | Set the custom number of learn requests. [default: 9] |
| param-template | STRING | --param-template | %k - key, %v - value. Example: --param-template 'user[%k]=%v'. Default: urlencoded - <%k=%v>, json - <"%k":%v>, headers - <%k=%v> |
| reflected-only | BOOLEAN | --reflected-only | Disable page comparison and search for reflected parameters only. |
| recursion-depth | STRING | --recursion-depth | Check the same list of parameters with the found parameters until there are no new parameters to be found. Conflicts with --verify for now. |
| disable-trustdns | BOOLEAN | --disable-trustdns | Can solve some dns related problems |
| follow-redirects | BOOLEAN | --follow-redirects | Follow redirections |
| progress-bar-len | STRING | --progress-bar-len | [default: 26] |
| custom-parameters | STRING | --custom-parameters | Check these parameters with non-random values like true/false yes/no (default is "admin bot captcha debug disable encryption env show sso test waf") |
| one-worker-per-host | BOOLEAN | --one-worker-per-host | Multiple urls with the same host will be checked one after another, |
| disable-progress-bar | BOOLEAN | --disable-progress-bar | Disable progress bar |
| disable-additional-checks | BOOLEAN | --disable-additional-checks | Disable additional checks |
| disable-custom-parameters | BOOLEAN | --disable-custom-parameters | Do not automatically check parameters like admin=true |
example
Run x8
# x8: mine hidden parameters on an endpointx8 --url 'https://api.example.com/v1/user' --wordlist params.txt --max 30[+] debug (reflected)[+] admin (length +412)[+] include (status 500)[+] source (reflected)[+] preview (length +88)[+] format (body changed)guidance
Choosing x8
Use x8 when a stable endpoint may hide undocumented parameters. Prefer ffuf for path and file discovery. Pair with an injection scanner to test values after discovery.
arjun
Another hidden parameter finder. x8 leans on full page comparison across query, body, and headers.
ffuf
General web fuzzer for paths and values. Use it to fuzz the parameters x8 discovers, not to find them.
faq
x8 questions
related
More Fuzzing tools
ffuf
A fast web fuzzer written in Go.
paramspider
Passive archive miner for parameterized URLs on a domain.
shortscan
Enumerate IIS 8.3 short filenames to recover hidden paths.
crithit
Directory and file brute forcing across many hosts.
ffuf-virtual-hosts
Host-header fuzzing packaged for vhost discovery.
medusa
Recursive HTTP directory and file fuzzer.
Run x8 yourself
A URL and a wordlist feed x8, which compares responses to confirm which hidden parameters the server honors and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.