HTTP Parameters

Find Parameters

Arjun

Find hidden HTTP parameters

# usage / install
pip3 install arjun
arjun --help
arjun -u $target_url

ParamSpider

Parameter miner for humans

git clone https://github.com/devanshbatham/ParamSpider
cd ParamSpider
pip3 install -r requirements.txt
python3 paramspider.py --domain $domain

Parameter Pollution

When you manipulate any parameter, it’s manipulation depends on how each web technology is parsing their parameters.

You can identify web technologies using “Wappalyzer”.

Below is the screenshot of some technologies and their parameter parsing.

Unicode char can cause breaks in some applications. Example with the pile of poo 💩 :

💩 Pile of Poo EmojiEmojipedia

pile of poo emoji

Understand it :

HTTP Parameter Pollution - It’s ContaminatedMedium