ParamSpider Cheat Sheet

Mines archived URLs to extract unique parameters for a domain from web archives.

Web Application SecurityparametersreconwaybackUpdated 2026-06-02

Overview

ParamSpider pulls historical URLs from web archives and extracts query parameters, producing wordlists for fuzzing and XSS/SQLi testing on authorized domains.

Authorized testing only. Use only on systems, networks, and accounts you own or have explicit written permission to test. Unauthorized access is illegal.

Install

git clone https://github.com/0xKayala/ParamSpider.git

cd ParamSpider && pip install -r requirements.txt

Essential commands

Extract parameters for domain

paramspider -d target.example

Exclude extensions

paramspider -d target.example --exclude png,jpg,gif,css,js

Common workflows

Build parameter wordlist for fuzzing —

paramspider -d target.example -o parameters.txt

cat parameters.txt | sort -u > params_unique.txt

Combine with httpx and dalfox —

paramspider -d target.example -o urls_with_params.txt

cat urls_with_params.txt | httpx -silent | dalfox pipe

Subdomain scope —

paramspider -d target.example --level high

Flags reference

`-d DOMAIN`	Target domain
`-l`	Level / depth (tool-specific)
`-o FILE`	Output file
`--exclude`	Comma-separated extensions to skip
`--placeholder`	Replace values with placeholder
`-q`	Quiet mode

Tips

Archive data may include stale endpoints—verify hosts still resolve and are in scope.
Deduplicate parameters before Intruder/sqlmap to save requests.
Pair with waybackurls/gau for broader URL collection, then ParamSpider for param extraction.
Respect rate limits when fetching archive APIs.