paramspecter

README

👻 PARAMSPECTER

Hidden-parameter discovery + injection-surface prober. Finds reflected params and probes each for XSS, SQLi & SSTI.

Discover the parameters an app forgot to tell you about — then find out which ones bite.

---

⚠️ Authorized testing only. Probe targets you own or have explicit written permission to assess.

✨ Features

• 🔍 Parameter mining — throws a wordlist of parameter names at an endpoint and detects which are reflected
• 💥 Reflected-XSS detection — injects a canary with breakout characters <>"' and reports which survive unencoded
• 🗄️ Error-based SQLi — injects a quote and matches 15+ database error signatures (MySQL, Postgres, MSSQL, Oracle, SQLite…)
• 🧩 SSTI (template injection) — {{7*7}}-style arithmetic canaries across 6 engines (Jinja2/Twig, ERB, Freemarker, Velocity, Smarty), and fingerprints the engine on a hit
• ⚡ Concurrent — bounded worker pool
• 🎛️ GET or POST, custom headers, probe selection (-only xss,sqli)
• 🧊 Single static binary, native Windows 11 (also Linux/macOS)

📦 Install

Download paramspecter.exe from Releases, or build:

git clone https://github.com/MrZXN777/paramspecter
cd paramspecter
go build -ldflags "-s -w" -o paramspecter.exe .

🚀 Usage

# Mine params + run all probes
paramspecter -u "https://example.com/search"

# Known param, SQLi only
paramspecter -u "https://example.com/page?id=1" -only sqli

# POST form, higher concurrency
paramspecter -u "https://example.com/form" -X POST -c 50

# Custom param list + JSON out
paramspecter -u "https://example.com/view" -w params.txt -json out.json

Options

Flag	Description	Default
-u	Target URL	—
-w	Parameter wordlist	built-in
-X	HTTP method	GET
-c	Concurrency	30
-only	Restrict probes: xss,sqli,ssti	all
-H	Custom header(s), ;;-separated	—
--json	Write JSON findings	—

🧪 How detection works

Probe	Technique
Reflected	Inject a unique canary; check it echoes back
XSS	Canary + <>"'; report characters reflected unencoded near the marker
SQLi	Inject '; match known DB error strings (error-based)
SSTI	Inject {{7*7}} etc.; if the response contains 49, the engine evaluated it

Each SSTI probe is guarded so its payload can never contain the expected output — no self-triggered false positives.

📄 License

MIT © MrZXN777

Documentation

Overview

PARAMSPECTER — hidden-parameter discovery and injection-surface prober.

Mines parameter names, detects reflection, and probes each reflected point for reflected-XSS, error-based SQLi, and server-side template injection.

Authorized testing only. Probe targets you own or are permitted to test.