Overview
Endpoints accept parameters — the inputs through which most vulnerabilities are reached — so discovering them is essential. This lesson covers parameter discovery.
Learning objectives
- Explain why parameters are key discovery targets.
- Describe discovering an endpoint's parameters (incl. hidden ones).
- Connect parameters to vulnerability hunting.
Core concept
Parameters are the named inputs endpoints accept — in the query string, request body, path, headers, and cookies. They are the primary channel for most web vulnerabilities (injection, IDOR/BOLA, XSS), so discovering which inputs each endpoint takes — including hidden or undocumented ones — is essential to coverage. A parameter inventory, tied to endpoints, tells the researcher exactly where untrusted input enters, directing precise vulnerability testing (building on the web-enumeration parameters lesson).
How it works
For each discovered endpoint, the researcher identifies its parameters: visible ones (in forms/links), plus hidden fields and undocumented/optional parameters the endpoint may accept. Sources include forms, client-side code (which often references parameters), and observed requests. Each parameter is cataloged with its apparent role, enabling the researcher to reason about relevant vulnerability classes — an identifier parameter suggests IDOR/authorization testing, one reaching a query suggests injection checks, one reflected in output suggests XSS. This parameter map focuses hunting precisely on where input enters, improving coverage and efficiency.
Practical example
Examining an in-scope endpoint, the researcher finds visible form parameters plus, from the client-side code, an undocumented optional parameter the endpoint accepts. Cataloging each with its role — an id parameter (IDOR/authorization candidate), a search field (injection/XSS candidate), and the undocumented parameter (test its effect) — focuses subsequent testing precisely where untrusted input enters. The hidden parameter, in particular, is a lead others might miss. Parameter discovery turned the endpoint into a set of concrete testing points.
Cybersecurity relevance
Parameters are the doorway to most web vulnerabilities, so thorough discovery (including hidden/undocumented parameters) is essential to coverage — missed parameters mean untested inputs and potentially missed (rewardable) findings. Discovering hidden parameters is a common way researchers find bugs others overlook. It mirrors attacker input-mapping and feeds the XSS/SQLi/authorization hunting modules. For defenders, it underscores validating and safely handling all parameters from all channels, including hidden ones. Parameter discovery directs precise, high-coverage hunting.
Common mistakes
- Only testing visible parameters, missing hidden/undocumented inputs (and the bugs in them).
- Not mapping parameters to vulnerability classes, weakening test focus.
- Overlooking non-body channels (headers, cookies, path) as parameter sources.
Key takeaways
- Parameters (query, body, path, headers, cookies) are the primary channel for injection, IDOR/BOLA, and XSS.
- Discover each endpoint's parameters, including hidden/undocumented ones (from forms, client-side code, observed requests), and map them to vulnerability classes.
- Thorough parameter discovery — especially finding hidden parameters — improves coverage and often surfaces bugs others miss; defenders must safely handle all parameters.
Check your understanding
- Why are parameters (including hidden ones) key discovery targets in bug bounty?
- How does mapping a parameter's role guide which vulnerability tests to apply?