x8

Hidden parameters discovery suite written in Rust.

The tool aids in identifying hidden parameters that could potentially be vulnerable or reveal interesting functionality that may be missed by other testers. Its high accuracy is achieved through line-by-line comparison of pages, comparison of response codes, and reflections.

Documentation

The documentation that explains every feature can be accessed at https://sh1yo.art/x8docs/. The source of the documentation is located at /docs.md.

Tree

• Features
• Examples
• Test site
• Usage
• Wordlists
• Burp Suite integration
• Installation

Features

• Fast.
• Offers flexible request configuration through the use of templates and injection points.
• Highly scalable, capable of checking thousands of URLs per run.
• Provides higher accuracy compared to similar tools, especially in difficult cases.
• Capable of discovering parameters with non-random values, such as admin=true.
• Highly configurable with a wide range of customizable options.
• Achieves almost raw requests through external library modification.

Examples

Check parameters in query

x8 -u "https://example.com/" -w <wordlist>

With default parameters:

x8 -u "https://example.com/?something=1" -w <wordlist>

/?something=1 equals to /?something=1&%s

Send parameters via body

x8 -u "https://example.com/" -X POST -w <wordlist>

Or with a custom body:

x8 -u "https://example.com/" -X POST -b '{"x":{%s}}' -w <wordlist>

%s will be replaced with different parameters like {"x":{"a":"b3a1a", "b":"ce03a", ...}}

Check multiple urls in paralell

x8 -u "https://example.com/" "https://4rt.one/" -W0

Custom template

x8 -u "https://example.com/" --param-template "user[%k]=%v" -w <wordlist>

Now every request would look like /?user[a]=hg2s4&user[b]=a34fa&...

Percent encoding

Sometimes parameters should be encoded. It is also possible:

x8 -u "https://example.com/?path=..%2faction.php%3f%s%23" --encode -w <wordlist>

GET /?path=..%2faction.php%3fWTDa8%3Da7UOS%26rTIDA%3DexMFp...%23 HTTP/1.1
Host: example.com

Search for headers

x8 -u "https://example.com" --headers -w <wordlist>

Search for header values

You can also target single headers:

x8 -u "https://example.com" --headers -H "Cookie: %s" -w <wordlist>

Test site

You can check the tool and compare it with other tools on the following urls:

https://4rt.one/level1 (GET)

https://4rt.one/level3 (GET)

Usage

USAGE:
    x8 [FLAGS] [OPTIONS]

FLAGS:
        --append                       Append to the output file instead of overwriting it.
    -B                                 Equal to -x http://localhost:8080
        --check-binary                 Check the body of responses with binary content types
        --disable-additional-checks    Private
        --disable-colors
        --disable-custom-parameters    Do not automatically check parameters like admin=true
        --disable-progress-bar
        --disable-trustdns             Can solve some dns related problems
        --encode                       Encodes query or body before making a request, i.e & -> %26, = -> %3D
                                       List of chars to encode: ", `, , <, >, &, #, ;, /, =, %
    -L, --follow-redirects             Follow redirections
        --force                        Force searching for parameters on pages > 25MB. Remove an error in case there's 1
                                       worker with --one-worker-per-host option.
    -h, --help                         Prints help information
        --headers                      Switch to header discovery mode.
                                       NOTE Content-Length and Host headers are automatically removed from the list
        --invert                       By default, parameters are sent within the body only in case PUT or POST methods
                                       are used.
                                       It's possible to overwrite this behavior by specifying the option
        --mimic-browser                Add default headers that browsers usually set.
        --one-worker-per-host          Multiple urls with the same host will be checked one after another,
                                       while urls with different hosts - are in parallel.
                                       Doesn't increase the number of workers
        --reflected-only               Disable page comparison and search for reflected parameters only.
        --remove-empty                 Skip writing to file outputs of url:method pairs without found parameters
        --replay-once                  If a replay proxy is specified, send all found parameters within one request.
        --strict                       Only report parameters that have changed the different parts of a page
        --test                         Prints request and response
    -V, --version                      Prints version information
        --verify                       Verify found parameters.

OPTIONS:
    -b, --body <body>                                       Example: --body '{"x":{%s}}'
                                                            Available variables: {{random}}
    -c <concurrency>                                        The number of concurrent requests per url [default: 1]
        --custom-parameters <custom-parameters>
            Check these parameters with non-random values like true/false yes/no
            (default is "admin bot captcha debug disable encryption env show sso test waf")
        --custom-values <custom-values>
            Values for custom parameters (default is "1 0 false off null true yes no")