Overview
Beyond discovering endpoints, web enumeration identifies the parameters each accepts — the inputs through which most web vulnerabilities are reached. This lesson covers parameter discovery and analysis.
Learning objectives
- Explain why parameters are a key enumeration target.
- Describe discovering an endpoint's parameters.
- Connect parameters to vulnerability testing.
Core concept
Parameters are the named inputs an endpoint accepts — in the query string, request body, path, headers, or cookies. Enumerating parameters means identifying which inputs each endpoint takes (including hidden or undocumented ones), because parameters are the primary channel through which attacks like injection, tampering/IDOR, and XSS are delivered. A thorough parameter inventory tells the tester exactly where untrusted input enters the application — the points to test.
How it works
For each discovered endpoint, the tester identifies its parameters: those visible in forms/links, plus hidden fields and undocumented or optional parameters the endpoint may accept. Knowing each parameter and its expected type/role lets the tester reason about relevant vulnerability classes — an id-style parameter suggests testing object-level authorization (IDOR); a parameter reaching a query suggests injection checks; one reflected in output suggests XSS checks. This parameter map, tied to endpoints, directs precise, in-scope testing rather than blind guessing.
Practical example
Enumerating an in-scope endpoint, the tester finds it accepts several parameters — some visible in the form and a hidden one plus an undocumented optional parameter. Each is cataloged with its apparent role: an identifier parameter (test for IDOR/authorization), a search field (test for injection/XSS), and the undocumented parameter (test how it affects behavior). This parameter inventory focuses subsequent testing precisely on where untrusted input enters, improving coverage and efficiency.
Cybersecurity relevance
Parameters are the doorway to most web vulnerabilities, so enumerating them thoroughly is essential to coverage — missed parameters (especially hidden/undocumented ones) mean untested inputs and potentially missed flaws. Testers systematically discover and analyze parameters to know where to apply injection, authorization, and XSS tests; attackers do the same. For defenders, it underscores validating and safely handling all parameters from all channels, including hidden and undocumented ones. Parameter enumeration directly feeds the testing phase.
Common mistakes
- Only testing visible form parameters, missing hidden/undocumented inputs.
- Not mapping parameters to relevant vulnerability classes, weakening test focus.
- Overlooking non-body parameter channels (headers, cookies, path).
Key takeaways
- Parameters are the named inputs endpoints accept (query, body, path, headers, cookies) and the primary channel for injection, IDOR, and XSS.
- Enumeration identifies each endpoint's parameters, including hidden/undocumented ones, mapping where untrusted input enters.
- Thorough parameter discovery focuses testing precisely and improves coverage; defenders must safely handle all parameters from all channels.
Check your understanding
- Why are parameters the primary target for many web vulnerability tests?
- Why is discovering hidden or undocumented parameters important for coverage?