Hey folks, today we are going to talk about an interesting tool called “ParamSpider“. It is extremely designed for scrap the vulnerable parameter from the web application that can be helpful during the penetration testing.
Key Features
- Finds parameters from subdomains as well.
- Finds parameters from web archives of the entered domain.
- Saves the output result in a nice and clean manner.
- Gives support to exclude urls with specific extensions.
- It mines the parameters from web archives (without interacting with the target host)
Lets do it 🙂 !!
Installation
First we need to download this tool from the github page which is pretty simple, just execute the following git command and tool will be download on terminal.
1 | git clone https://github.com/devanshbatham/ParamSpider |
Go into the directory by cd command.
1 | cd ParamSpider |
Before start this tool we need to fulfill some requirements of this tool.
1 | pip3 install -r requirements.txt |
Simple Scan
Now first we will take an example without adding the filter. Through this command we will try to find all parameters in which some can be harmful or non-harmful parameters.
Usage 🙂 pythin3 paramspider.py –domain < site URL >
1 | python3 paramspider.py --domain secnhack.in |
Exclude
Now we will use the exclude function of this tool to improve our results.
1 | python3 paramspider.py --domain secnhack.in --exclude php,jpg,svg |
Nested
Now we will find only the nested parameter by uses the following command.
1 | python3 paramspider.py --domain secnhack.in --level high |
Output
We will save our results in txt file.
1 | python3 paramspider.py --domain secnhack.in --output results.txt |
Exclude subdomains
If we do not want this tool to scan the subdomain then we can use the deprecated function of this tool.
1 | python3 paramspider.py --domain secnhack.in --subs False |
Similarly, you can find unsafe parameters using this tool and after that you can start fuzzing to detect the vulnerability in the web application.
A keen learner and passionate IT student. He has done Web designing, CCNA, RedHat, Ethical hacking, Network & web penetration testing. Currently, he is completing his graduation and learning about Red teaming, CTF challenges & Blue teaming.
