I have recently identified a controller that handles query string parameters that are not obvious, by simply guessing query string parameters. E.g.


Is there a tool that takes a base URL and builds several variants from it with common query string parameters?

  • [F12] > Console > paste for(i=0;i<100;i++) new Image().src="?guessed_param="+i; [Enter]
    – dandavis
    Jul 11, 2017 at 17:31

1 Answer 1


I'd recommend looking at something like Burp suite's intruder feature for this. that can easily create a variety of URLs from a base, and includes preset lists.

Another option would be to look at OWASP ZAP which is a similar application.

  • 2nd OWASP ZAP. It's free and very easy to use for stuff like this.
    Jul 11, 2017 at 9:37

Not the answer you're looking for? Browse other questions tagged .