Parameter Miner
Collect parameter names from URLs, HTML forms, JavaScript, JSON bodies, path templates and GraphQL variables you already have, and see where each appears.
Runs in your browser Your input never leaves your device.
| Name | Found as | Seen | Example | In | Hint |
|---|
Names are read in your browser from text you provide. Nothing is requested or sent. A name seen here is a candidate to look at, not proof the application accepts it.
Report a problem with this tool
About this tool
Applications describe the parameters they accept in many places: query strings in links, form fields in HTML, the keys of request bodies in JavaScript, JSON samples, route templates and GraphQL operations. This tool reads text you provide and collects them into one list so you can see a target's real vocabulary instead of guessing from a generic wordlist. It reads query strings in any URL or fragment, the name of every form control (input, select, textarea, button) together with the form's method and action, JavaScript that reads parameters (URLSearchParams and searchParams, req.query and req.body, request.args, $_GET and $_POST, getParameter, FormData append and set), the top-level keys of objects sent as params, data, body or JSON.stringify and as the second argument of post, put and patch calls, every key in a JSON document with its path, path parameters written as :id, {id} or <int:id>, and GraphQL operation variables. Each name shows where it was found, how often, an example value, which form or object it belonged to and a hint when the name looks like a redirect, a file or path, an object reference, a command, a secret, a search term or a debug switch. Filter by source or hint and copy the names as a wordlist or download a CSV. Form control names and query keys were compared with Python's html.parser and urllib on fixed and random input. The JavaScript readers are pattern based, so parameters built dynamically at run time can be missed. Nothing is requested or sent, and a name found here is only a candidate to look at.
How to use it
- Paste URLs, HTML, JavaScript or JSON, or load files.
- Read the summary to see which kinds of source produced names.
- Filter by source or hint, or search for a name.
- Copy the names as a wordlist, or download the table as CSV.
Common problems
- A parameter I expected is missing
- It may be built at run time or sent in a header or cookie, which this tool does not read. Form fields with only an id are skipped unless you tick the option.
- Too many generic names
- Filter by source, for example form fields only, or by hint. Names that appear in many places are listed first.
- A JSON key shows with a dotted path
- Keys of JSON documents are listed by their last name, and the full path is shown in the In column.