> For the complete documentation index, see [llms.txt](https://book.redsquad.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.redsquad.xyz/web-hacking/http-stuff/parameters.md).

# HTTP Parameters

## Find Parameters

### Arjun

> Find hidden HTTP parameters

```bash
# usage / install
pip3 install arjun
arjun --help
arjun -u $target_url
```

### ParamSpider

> Parameter miner for humans

```bash
git clone https://github.com/devanshbatham/ParamSpider
cd ParamSpider
pip3 install -r requirements.txt
python3 paramspider.py --domain $domain
```

## Parameter Pollution

{% hint style="info" %}
When you manipulate any parameter, it’s manipulation depends on how each web technology is parsing their parameters.

You can identify web technologies using “[Wappalyzer](https://addons.mozilla.org/en-US/firefox/addon/wappalyzer/)”.

Below is the screenshot of some technologies and their parameter parsing.
{% endhint %}

![](https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2Fgit-blob-0e4ded13f185df82b79f5c96b4eaba95cd290684%2Fimage.png?alt=media)

Unicode char can cause breaks in some applications. Example with the pile of poo 💩 :

{% embed url="<https://emojipedia.org/pile-of-poo/>" %}
pile of poo emoji
{% endembed %}

> Understand it :

{% embed url="<https://shahjerry33.medium.com/http-parameter-pollution-its-contaminated-85edc0805654>" %}