Web Application

ParamSpider

Mines parameters from web archives for a domain.

beginner

Linux

Reconnaissance

Enumeration

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Building param-rich URL lists for XSS/SQLi testing.

Run on domain; clean output; feed dalfox/sqlmap.

Historical params often still work on live apps.

Commands & usage

paramspider -d example.com

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

ffuf

Fast web fuzzer for directories, vhosts, parameters, and more.

Gobuster

Directory/DNS/vhost brute-forcing tool written in Go.

Feroxbuster

Recursive content discovery tool with smart filtering.

dirsearch

Feature-rich web path scanner in Python.

Wfuzz

Flexible web application fuzzer for params, headers, auth, etc.

Nuclei

Template-based vulnerability scanner with huge community template set.