x8

Find hidden parameters

$ x8 -u [https://example.com/page] -w [params.txt]

$ x8 -u [url] -w [wordlist] -H "[Cookie: value]"

$ x8 -u [url] -w [wordlist] -o [output.txt]

$ x8 -l [urls.txt] -w [params.txt]

x8 [-u url] [-w wordlist] [-H header] [options]

x8 is a hidden parameter discovery tool for web applications used in authorized security testing and bug bounty research. It sends requests with candidate parameter names from a wordlist and analyzes responses to identify parameters that the application accepts but does not publicly document.
The tool supports discovery through multiple HTTP methods including GET query parameters, POST body data, and HTTP headers. Concurrent request handling enables fast scanning, and multiple URLs can be processed from a file for batch testing.

-u URL

Target URL.

URL list.

Parameter wordlist.

Custom header.

Output file.

Authorized use only. May be detected. Rust implementation.

x8 was created for hidden parameter discovery in web applications during security testing.

arjun(1), paramspider(1), ffuf(1)