URL query string guessing [closed]

Question

I have recently identified a controller that handles query string parameters that are not obvious, by simply guessing query string parameters. E.g.

http://domain.com/controller.php?guessed_param=18

Is there a tool that takes a base URL and builds several variants from it with common query string parameters?

Answer 1

I'd recommend looking at something like Burp suite's intruder feature for this. that can easily create a variety of URLs from a base, and includes preset lists.

Another option would be to look at OWASP ZAP which is a similar application.