x8

The tool helps to find hidden parameters that can be vulnerable or can reveal interesting functionality that other hunters miss. Greater accuracy is achieved thanks to the line-by-line comparison of pages, comparison of response code and reflections.

Name:x8

Category:Fuzzing

Publisher:trickest

Created:7/22/2021

Container:quay.io/trickest/x8:ab1ba6c-patch-1

Output Type:

License:Unknown

Source:View Source

Parameters

max · string

--maxChange the maximum number of parameters per request. (default is <= 256 for query, 64 for headers and 512 for body)

url · string · required

--urlYou can add a custom injection point with %s. Multiple values are supported: https://url1 http://url2

body · string

--bodyExample body: '{x:{%s}}'

http · string

--httpHTTP version. Supported versions: --http 1.1, --http 2

port · string

--portPort to use with request file

test · boolean

--testPrints request and response

delay · string

--delayDelay between requests in milliseconds [default: 0]

force · boolean

--forceForce searching for parameters on pages > 25MB. Remove an error in case there's 1

proto · string

--protoProtocol to use with request file (default is https)

proxy · string

--proxyProxy

encode · boolean

--encodeEncodes query or body before making a request, i.e & -> %26, = -> %3D

invert · boolean

--invertBy default, parameters are sent within the body only in case PUT or POST methods

joiner · string

--joinerHow to join parameter templates. Example: --joiner '&'. Default: urlencoded - '&', json - ', ', header values - '; '

method · string

--methodMultiple values are supported: -X GET POST

strict · boolean

--strictOnly report parameters that have changed the different parts of a page

verify · boolean

--verifyVerify found parameters.

headers · string

-HExample: 'one:one' 'two:two'

request · file

--requestThe file with the raw http request

timeout · string

--timeoutHTTP request timeout in seconds. [default: 15]

verbose · string

--verboseVerbose level 0/1/2 [default: 1]

workers · string

--workersThe number of concurrent url checks. [default: 1]

split-by · string

--split-bySplit the request into lines by the provided sequence. By default splits by , and

url-list · file · required

--urlYou can add a custom injection point with %s. Multiple values are supported: https://url1 http://url2

wordlist · file · required

--wordlist-w, --wordlist <wordlist>

data-type · string

--data-type-t, --data-type <data-type>

concurrency · string

-cThe number of concurrent requests per url [default: 1]

replay-once · boolean

--replay-onceIf a replay proxy is specified, send all found parameters within one request.

check-binary · boolean

--check-binaryCheck the body of responses with binary content types

remove-empty · boolean

--remove-emptySkip writing to file outputs of url:method pairs without found parameters

replay-proxy · string

--replay-proxyRequest target with every found parameter via the replay proxy at the end.

custom-values · string

--custom-valuesValues for custom parameters (default is 1 0 false off null true yes no)

mimic-browser · boolean

--mimic-browserAdd default headers that browsers usually set.

output-format · string

--output-formatstandart, json, url, request [default: standart]

disable-colors · boolean

--disable-colorsDisable colors

learn-requests · string

--learn-requestsSet the custom number of learn requests. [default: 9]

param-template · string

--param-template%k - key, %v - value. Example: --param-template 'user[%k]=%v'. Default: urlencoded - <%k=%v>, json - <%k:%v>, headers - <%k=%v>

reflected-only · boolean

--reflected-onlyDisable page comparison and search for reflected parameters only.

recursion-depth · string

--recursion-depthCheck the same list of parameters with the found parameters until there are no new parameters to be found. Conflicts with --verify for now.

disable-trustdns · boolean

--disable-trustdnsCan solve some dns related problems

follow-redirects · boolean

--follow-redirectsFollow redirections

progress-bar-len · string

--progress-bar-len[default: 26]

custom-parameters · string

--custom-parametersCheck these parameters with non-random values like true/false yes/no (default is admin bot captcha debug disable encryption env show sso test waf)

one-worker-per-host · boolean

--one-worker-per-hostMultiple urls with the same host will be checked one after another,

disable-progress-bar · boolean

--disable-progress-barDisable progress bar

disable-additional-checks · boolean

--disable-additional-checksDisable additional checks

disable-custom-parameters · boolean

--disable-custom-parametersDo not automatically check parameters like admin=true