HTTP Hidden Parameters
SourceOn the Atlas> Web applications often have hidden or undocumented parameters that are not exposed in the user interface. Fuzzing can help discover these parameters, which might be vulnerable to various attacks.
Payloads · Information Disclosure
Hidden Parameters
Web applications often have hidden or undocumented parameters that are not exposed in the user interface. Fuzzing can help discover these parameters, which might be vulnerable to various attacks.
For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.
From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky. The repository.
3 of 3 passages
Bruteforce Parameters
SourceOn the Atlas* Use wordlists of common parameters and send them, look for unexpected behavior from the backend. ```ps1 x8 -u "https://example.com/" -w <wordlist> x8 -u "https://example.com/" -X POST -w <wordlist> ``` Wordlist examples: * [Arjun/large.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/large.txt) * [Arjun/medium.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/medium.txt) * [Arjun/small.txt](https://github.com/s0md3v/Arjun/blob/master/arjun/db/small.txt) * [samlists/sam-cc-parameters-lowercase-all.txt](https://github.com/the-xentropy/samlists/blob/main/sam-cc-parameters-lowercase-all.txt) * [samlists/sam-cc-parameters-mixedcase-all.txt](https://github.com/the-xentropy/samlists/blob/main/sam-cc-parameters-mixedcase-all.txt)
Old Parameters
SourceOn the AtlasExplore all the URL from your targets to find old parameters. * Browse the [Wayback Machine](http://web.archive.org/) * Look through the JS files to discover unused parameters
Data as of 2026-11-14.