[{"data":1,"prerenderedAt":496},["ShallowReactive",2],{"announcement":3,"i-tabler:sun":11,"i-tabler:moon":16,"i-tabler:menu-2":18,"i-tabler:x":20,"i-simple-icons:youtube":22,"i-simple-icons:github":24,"i-simple-icons:x":26,"i-simple-icons:linkedin":28,"i-tabler:arrow-up-right":31,"post-discover-hidden-parameters-for-web-app-vulnerabilities":33,"post-nav-discover-hidden-parameters-for-web-app-vulnerabilities":474,"video-discover-hidden-parameters-for-web-app-vulnerabilities":486,"i-tabler:copy":494},{"startsAt":4,"endsAt":5,"scramble":6,"cta":7,"message":10},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":8,"label":9},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":15},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":23},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":25},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":27},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":29,"hidden":30},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",{"id":34,"title":35,"body":36,"categories":459,"coverImage":463,"date":464,"description":465,"draft":14,"extension":466,"meta":467,"navigation":30,"noindex":14,"path":468,"readingTime":469,"seo":470,"slug":471,"stem":471,"updatedAt":472,"youtubeId":42,"__hash__":473},"blog\u002Fdiscover-hidden-parameters-for-web-app-vulnerabilities.md","Discover Hidden Parameters for Web App Vulnerabilities 🔍🕵️‍♂️",{"type":37,"value":38,"toc":444},"minimark",[39,43,48,52,65,73,80,113,119,122,135,138,153,159,200,203,232,235,280,283,302,310,315,322,337,342,345,374,377,407,411,421,440],[40,41],"post-media",{"video":42},"q5VT1js5KZg",[44,45,47],"h2",{"id":46},"introduction","Introduction",[49,50,51],"p",{},"In the ever-evolving realm of cybersecurity, the quest to unveil hidden parameters within web applications takes center stage. Armed with powerful tools like Arjun and Waybackurls, security enthusiasts, penetration testers, and bug bounty hunters gain a comprehensive toolkit for identifying potential vulnerabilities. In this guide, we embark on an in-depth exploration of these methods, providing step-by-step insights to elevate your web security endeavors.",[44,53,55,64],{"id":54},"arjunmethod",[56,57,63],"a",{"href":58,"rel":59,"target":62},"https:\u002F\u002Fgithub.com\u002Fs0md3v\u002FArjun?utm_source=amrelsagaei.com&utm_medium=referral",[60,61],"noopener","noreferrer","_blank","Arjun","Method",[66,67,69],"h4",{"id":68},"installation",[70,71,72],"strong",{},"Installation",[49,74,75,76,79],{},"Ensure you have ",[56,77,63],{"href":58,"rel":78,"target":62},[60,61],"installed on your machine by executing the following command:",[81,82,87],"pre",{"code":83,"language":84,"meta":85,"className":86,"style":85},"sudo apt install arjun -y\n","bash","","shiki shiki-themes vitesse-dark vitesse-light",[88,89,90],"code",{},[91,92,95,99,103,106,109],"span",{"class":93,"line":94},"line",1,[91,96,98],{"class":97},"swzfi","sudo",[91,100,102],{"class":101},"sRRDT"," apt",[91,104,105],{"class":101}," install",[91,107,108],{"class":101}," arjun",[91,110,112],{"class":111},"se4ZP"," -y\n",[66,114,116],{"id":115},"usage",[70,117,118],{},"Usage",[49,120,121],{},"Explore Arjun's capabilities by checking its help menu",[81,123,125],{"code":124,"language":84,"meta":85,"className":86,"style":85},"arjun -h\n",[88,126,127],{},[91,128,129,132],{"class":93,"line":94},[91,130,131],{"class":97},"arjun",[91,133,134],{"class":111}," -h\n",[49,136,137],{},"To analyze a specific URL for hidden parameters, use the following command:",[81,139,141],{"code":140,"language":84,"meta":85,"className":86,"style":85},"arjun -u http:\u002F\u002Fexample.com\u002F\n",[88,142,143],{},[91,144,145,147,150],{"class":93,"line":94},[91,146,131],{"class":97},[91,148,149],{"class":111}," -u",[91,151,152],{"class":101}," http:\u002F\u002Fexample.com\u002F\n",[49,154,155,158],{},[56,156,63],{"href":58,"rel":157,"target":62},[60,61],"offers flexibility by allowing you to specify the type of request data to search for, such as GET, POST, or JSON parameters",[81,160,162],{"code":161,"language":84,"meta":85,"className":86,"style":85},"arjun -u http:\u002F\u002Fexample.com\u002F --get\narjun -u http:\u002F\u002Fexample.com\u002F --post\narjun -u http:\u002F\u002Fexample.com\u002F --json\n",[88,163,164,176,188],{},[91,165,166,168,170,173],{"class":93,"line":94},[91,167,131],{"class":97},[91,169,149],{"class":111},[91,171,172],{"class":101}," http:\u002F\u002Fexample.com\u002F",[91,174,175],{"class":111}," --get\n",[91,177,179,181,183,185],{"class":93,"line":178},2,[91,180,131],{"class":97},[91,182,149],{"class":111},[91,184,172],{"class":101},[91,186,187],{"class":111}," --post\n",[91,189,191,193,195,197],{"class":93,"line":190},3,[91,192,131],{"class":97},[91,194,149],{"class":111},[91,196,172],{"class":101},[91,198,199],{"class":111}," --json\n",[49,201,202],{},"Extend your exploration by providing a list of multiple URLs or utilizing a custom wordlist for parameter names:",[81,204,206],{"code":205,"language":84,"meta":85,"className":86,"style":85},"arjun --urls urls.txt\narjun -u http:\u002F\u002Fexample.com\u002F -f parameters.txt\n",[88,207,208,218],{},[91,209,210,212,215],{"class":93,"line":94},[91,211,131],{"class":97},[91,213,214],{"class":111}," --urls",[91,216,217],{"class":101}," urls.txt\n",[91,219,220,222,224,226,229],{"class":93,"line":178},[91,221,131],{"class":97},[91,223,149],{"class":111},[91,225,172],{"class":101},[91,227,228],{"class":111}," -f",[91,230,231],{"class":101}," parameters.txt\n",[49,233,234],{},"Customize the number of threads and the delay between requests for optimal performance:",[81,236,238],{"code":237,"language":84,"meta":85,"className":86,"style":85},"arjun -u http:\u002F\u002Fexample.com\u002F -t 16\narjun -u http:\u002F\u002Fexample.com\u002F -d 5\narjun -u http:\u002F\u002Fexample.com\u002F --stable\n",[88,239,240,255,269],{},[91,241,242,244,246,248,251],{"class":93,"line":94},[91,243,131],{"class":97},[91,245,149],{"class":111},[91,247,172],{"class":101},[91,249,250],{"class":111}," -t",[91,252,254],{"class":253},"sUQhE"," 16\n",[91,256,257,259,261,263,266],{"class":93,"line":178},[91,258,131],{"class":97},[91,260,149],{"class":111},[91,262,172],{"class":101},[91,264,265],{"class":111}," -d",[91,267,268],{"class":253}," 5\n",[91,270,271,273,275,277],{"class":93,"line":190},[91,272,131],{"class":97},[91,274,149],{"class":111},[91,276,172],{"class":101},[91,278,279],{"class":111}," --stable\n",[49,281,282],{},"Save and analyze results in JSON format:",[81,284,286],{"code":285,"language":84,"meta":85,"className":86,"style":85},"arjun -u http:\u002F\u002Fexample.com\u002F -o results.json\n",[88,287,288],{},[91,289,290,292,294,296,299],{"class":93,"line":94},[91,291,131],{"class":97},[91,293,149],{"class":111},[91,295,172],{"class":101},[91,297,298],{"class":111}," -o",[91,300,301],{"class":101}," results.json\n",[44,303,305,64],{"id":304},"waybackurlsmethod",[56,306,309],{"href":307,"rel":308,"target":62},"https:\u002F\u002Fgithub.com\u002Ftomnomnom\u002Fwaybackurls?utm_source=amrelsagaei.com&utm_medium=referral",[60,61],"Waybackurls",[66,311,313],{"id":312},"installation-1",[70,314,72],{},[49,316,317,318,321],{},"For the second method, leverage the capabilities of ",[56,319,309],{"href":307,"rel":320,"target":62},[60,61],". Install it with the following command:",[81,323,325],{"code":324,"language":84,"meta":85,"className":86,"style":85},"go install github.com\u002Ftomnomnom\u002Fwaybackurls@latest\n",[88,326,327],{},[91,328,329,332,334],{"class":93,"line":94},[91,330,331],{"class":97},"go",[91,333,105],{"class":101},[91,335,336],{"class":101}," github.com\u002Ftomnomnom\u002Fwaybackurls@latest\n",[66,338,340],{"id":339},"usage-1",[70,341,118],{},[49,343,344],{},"Create a file containing the target domain:",[81,346,348],{"code":347,"language":84,"meta":85,"className":86,"style":85},"echo domain.com | waybackurls | tee URLs.txt\n",[88,349,350],{},[91,351,352,356,359,363,366,368,371],{"class":93,"line":94},[91,353,355],{"class":354},"s6_DI","echo",[91,357,358],{"class":101}," domain.com",[91,360,362],{"class":361},"sfIIG"," |",[91,364,365],{"class":97}," waybackurls",[91,367,362],{"class":361},[91,369,370],{"class":97}," tee",[91,372,373],{"class":101}," URLs.txt\n",[49,375,376],{},"Filter URLs with parameters to create a focused list",[81,378,380],{"code":379,"language":84,"meta":85,"className":86,"style":85},"cat URLs.txt | grep =$ >> parameters.txt\n",[88,381,382],{},[91,383,384,387,390,392,395,398,402,405],{"class":93,"line":94},[91,385,386],{"class":97},"cat",[91,388,389],{"class":101}," URLs.txt",[91,391,362],{"class":361},[91,393,394],{"class":97}," grep",[91,396,397],{"class":101}," =",[91,399,401],{"class":400},"sG2Fq","$ ",[91,403,404],{"class":361},">>",[91,406,231],{"class":101},[44,408,410],{"id":409},"conclusion","Conclusion",[49,412,413,416,417,420],{},[56,414,63],{"href":58,"rel":415,"target":62},[60,61],"and ",[56,418,309],{"href":307,"rel":419,"target":62},[60,61],"emerge as indispensable allies in discovering hidden parameters. Whether you're a seasoned penetration tester or a security enthusiast, these methods provide detailed insights into potential vulnerabilities within web applications. As you navigate the intricate landscape of web security, incorporate these techniques into your arsenal, fortifying your defenses and staying one step ahead of potential threats.",[49,422,423,426,433,436,437],{},[70,424,425],{},"If you have any questions about this tutorial please leave a comment below or reach out to me on Twitter",[56,427,430],{"href":428,"rel":429,"target":62},"https:\u002F\u002Ftwitter.com\u002Famrelsagaei?utm_source=amrelsagaei.com&utm_medium=referral",[60,61],[70,431,432],{},"@amrelsagaei",[70,434,435],{},"."," ",[70,438,439],{},"Happy hunting!",[441,442,443],"style",{},"html pre.shiki code .swzfi, html code.shiki .swzfi{--shiki-default:#80A665;--shiki-light:#59873A}html pre.shiki code .sRRDT, html code.shiki .sRRDT{--shiki-default:#C98A7D;--shiki-light:#B56959}html pre.shiki code .se4ZP, html code.shiki .se4ZP{--shiki-default:#C99076;--shiki-light:#A65E2B}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html pre.shiki code .sUQhE, html code.shiki .sUQhE{--shiki-default:#4C9A91;--shiki-light:#2F798A}html pre.shiki code .s6_DI, html code.shiki .s6_DI{--shiki-default:#B8A965;--shiki-light:#998418}html pre.shiki code .sfIIG, html code.shiki .sfIIG{--shiki-default:#CB7676;--shiki-light:#AB5959}html pre.shiki code .sG2Fq, html code.shiki .sG2Fq{--shiki-default:#DBD7CAEE;--shiki-light:#393A34}",{"title":85,"searchDepth":190,"depth":190,"links":445},[446,447,453,458],{"id":46,"depth":178,"text":47},{"id":54,"depth":178,"text":448,"children":449},"ArjunMethod",[450,452],{"id":68,"depth":451,"text":72},4,{"id":115,"depth":451,"text":118},{"id":304,"depth":178,"text":454,"children":455},"WaybackurlsMethod",[456,457],{"id":312,"depth":451,"text":72},{"id":339,"depth":451,"text":118},{"id":409,"depth":178,"text":410},[460,461,462],"Bug Bounty","Linux","Penetration Testing","\u002Fimages\u002Fblog\u002Fdiscover-hidden-parameters-for-web-app-vulnerabilities\u002Farjun-waybackurls.jpg","2024-03-25","Find undocumented parameters in web applications using Arjun and Waybackurls, and turn those hidden inputs into real attack surface.","md",{},"\u002Fdiscover-hidden-parameters-for-web-app-vulnerabilities",null,{"title":35,"description":465},"discover-hidden-parameters-for-web-app-vulnerabilities","2025-02-05","gaRTiapZgqMxEUSOIQ26HOB8tLlxLFlWHGybbYMz0Cw",{"older":475,"newer":480,"total":485},{"slug":476,"title":477,"date":478,"position":479},"segfault-your-ultimate-cybersecurity-workspace","SegFault: Your Ultimate Cybersecurity Workspace 🌐🔒","2024-03-04",52,{"slug":481,"title":482,"date":483,"position":484},"create-your-blackhatchat-right-now","Create Your BlackHatChat RIGHT NOW! 🚀🌐","2024-04-01",50,68,{"id":42,"title":35,"published":487,"url":488,"description":489,"durationSeconds":490,"viewCount":491,"thumbnail":492,"thumbnailSrcset":493},"2024-03-25T19:00:25Z","https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=q5VT1js5KZg","Uncover the secrets of web app vulnerabilities in our latest video! 🌐🕵️‍♂️ Join us as we explore two powerful methods using Arjun and Waybackurls to discover hidden parameters, spot potential weaknesses, and enhance your cybersecurity skills. 🔍💻",316,2717,"\u002Fimages\u002Fvideos\u002Fq5VT1js5KZg-800.webp","\u002Fimages\u002Fvideos\u002Fq5VT1js5KZg-800.webp 800w, \u002Fimages\u002Fvideos\u002Fq5VT1js5KZg-1280.webp 1280w",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":495},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M7 9.667A2.667 2.667 0 0 1 9.667 7h8.666A2.667 2.667 0 0 1 21 9.667v8.666A2.667 2.667 0 0 1 18.333 21H9.667A2.667 2.667 0 0 1 7 18.333z\"\u002F>\u003Cpath d=\"M4.012 16.737A2 2 0 0 1 3 15V5c0-1.1.9-2 2-2h10c.75 0 1.158.385 1.5 1\"\u002F>\u003C\u002Fg>",1791941259502]