ParamSpider: Parameter miner for humans

Key Features:

• Mines parameters from web archives (Wayback Machine) without touching the target host
• Discovers parameters from subdomains by default
• Supports JSON output for tool chaining (--json)
• Pipes results directly to stdout (--stdout) for use with httpx, nuclei, grep, etc.
• Excludes URLs by file extension (--exclude)
• Finds nested parameters (--level high)
• Custom placeholder string (--placeholder)
• Connection pooling for faster retries
• Retry logic with configurable attempts

Usage instructions:

Requires: Python 3.8+

$ git clone https://github.com/viphacker100/ParamSpider
$ cd ParamSpider
$ pip install -r requirements.txt
$ python paramspider.py --domain hackerone.com

Usage options:

1 - Simple scan (includes subdomains by default)
$ python paramspider.py --domain hackerone.com
-> Output: https://hackerone.com/test.php?q=FUZZ

2 - Exclude URLs with specific extensions
$ python paramspider.py --domain hackerone.com --exclude php,jpg,svg

3 - Find nested parameters
$ python paramspider.py --domain hackerone.com --level high
-> Output: https://hackerone.com/test.php?p=test&q=FUZZ

4 - Save results to a file
$ python paramspider.py --domain hackerone.com --exclude php,jpg --output hackerone.txt

5 - Custom placeholder (default is FUZZ)
$ python paramspider.py --domain hackerone.com --placeholder CUSTOM

6 - Quiet mode (suppress console output)
$ python paramspider.py --domain hackerone.com --quiet

7 - Exclude subdomains
$ python paramspider.py --domain hackerone.com --subs false

8 - Retry failed requests
$ python paramspider.py --domain hackerone.com --retries 5

9 - JSON output (for tool chaining)
$ python paramspider.py --domain hackerone.com --json
-> Output: {"domain": "hackerone.com", "parameters": [...], "count": 123}

10 - Pipe to stdout only (no file saved)
$ python paramspider.py --domain hackerone.com --stdout

11 - Pipe JSON to stdout (for httpx, nuclei, etc.)
$ python paramspider.py --domain hackerone.com --json --stdout | httpx -silent
$ python paramspider.py --domain hackerone.com --json --stdout | nuclei -t params.yaml

12 - Version check
$ python paramspider.py --version

CLI flags:

Flag	Description	Default
-d, --domain	Target domain (required)	—
-s, --subs	Include subdomains (true/false)	true
-l, --level	high for nested parameters	—
-e, --exclude	Comma-separated extensions to skip	—
-o, --output	Output filename	output/{domain}.txt
-p, --placeholder	Placeholder string for parameter values	FUZZ
-q, --quiet	Suppress console output	false
-r, --retries	Number of retries on error	3
--json	Output in JSON format	false
--stdout	Print to stdout only (no file)	false
--version	Show version	—

ParamSpider + GF (for massive pwnage)

Let's say you have already installed ParamSpider and now you want to filter out the juicy parameters from plethora of parameters. No worries you can easily do it using GF(by tomnomnom).

Note: Make sure you have go properly installed on your machine.

Follow along this:

$ go get -u github.com/tomnomnom/gf
$ cp -r $GOPATH/src/github.com/tomnomnom/gf/examples ~/.gf

Note: Replace '/User/levi/go/bin/gf' with the path where gf binary is located in your system.

$ alias gf='/User/levi/go/bin/gf'
$ cd ~/.gf/

Note: Paste JSON files(https://github.com/0xKayala/ParamSpider/tree/master/gf_profiles) in ~/.gf/ folder

Now run ParamSpider and navigate to the output directory

$ gf redirect domain.txt   # for potential open redirect/SSRF parameters
$ gf xss domain.txt        # for potential xss vulnerable parameters
$ gf potential domain.txt  # for xss + ssrf + open redirect parameters
$ gf wordpress domain.txt  # for wordpress urls

Example:

$ python paramspider.py --domain bugcrowd.com --exclude woff,css,js,png,svg,php,jpg --output bugcrowd.txt

Note:

As it fetches the parameters from web archive data,
so chances of false positives are high.

Contributing to ParamSpider:

• Report bugs, missing best practices
• Shoot my DM with new ideas
• Make more GF profiles (.json files)
• Help in Fixing bugs
• Submit Pull requests

My Twitter :

Say hello: 0xAsm0d3us