Tool for mining parameters from web archives to discover hidden endpoints, GET/POST parameters, and potential injection points.
paramspider {flags} {domain} 📎 flags 📎 domain paramspider {flags} {domain}Sandbox: execFile · Timeout: 120s
web.discovery.endpoint web.enumeration.parameter security.recon.passive web.archive.url | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
domain | string | No | - | Target domain name | -d, --domain |
flag-o | string | No | - | Output file path | -o, --output |
flag-level | string | No | - | Filter level (high, low) | -l, --level |
flag-exclude | string | No | - | Exclude file extensions (comma separated) | -e, --exclude |
flag-priority | boolean | No | - | Only show URLs with parameters | -p, --priority |
flag-silent | boolean | No | - | Silent mode | -s, --silent |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
crawl.txt | Discovered parameterized URLs | text/plain | - | verified |
Inputs
network.target.domain Target domain to mine parameters from
Outputs
crawl.txt List of URLs with discovered parameters
network_traffic Produces
crawl.txtConsumes
network.target.domain| Resource | Value |
|---|---|
| CPU | low |
| Memory | 64 MB |
| Network | low |
| Disk I/O | low |
Mine parameters for a domain
paramspider -d example.comMine with custom output file
paramspider -d example.com -o results.txtExclude image file extensions
paramspider -d example.com --exclude png,jpg,gif,css,jsHigh-level filtering for cleaner results
paramspider -d example.com --level high --prioritySilent mode for pipeline
paramspider -d example.com --silent | httpx -status-code -titleParamSpider mines parameters from web archive sources to discover hidden GET/POST parameters and potential injection points for web applications. It helps identify attack surface that may be missed by traditional crawling.
# Mine parameters and test with ffuf
paramspider -d target.com --silent | sort -u | ffuf -u "DOMAIN" -w - -mc 200
# Mine and probe live endpoints
paramspider -d target.com --silent | grep "\.php" | httpx -status-code
# Mine parameters with high-level filtering
paramspider -d target.com --level high --priority -o params.txt