CmdID

CmdID / Commands

x8

A hidden parameters discovery suite for identifying vulnerable or interesting web parameters. tldr-pages

On several platforms

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Check hidden parameters in a URL query

x8 --url https://example.com/ --wordlist path/to/wordlist.txtIdentify

Check parameters with a custom query injection point (%s)

x8 --url https://example.com/?something=1%26%s --wordlist path/to/wordlist.txtIdentify

Send parameters via POST body with JSON format

x8 --url https://example.com/ --method POST --body '{"x":{%s\}\}' --wordlist path/to/wordlist.txtIdentify

Check parameters with a custom template (%k for key, %v for value)

x8 --url https://example.com/ --param-template user[%k]=%v --wordlist path/to/wordlist.txtIdentify

Encode parameters for special characters in queries

x8 --url https://example.com/?path=..%2faction.php%3f%s%23 --encode --wordlist path/to/wordlist.txtIdentify

Discover hidden headers for a URL

x8 --url https://example.com/ --headers --wordlist path/to/headers.txtIdentify

Check multiple URLs in parallel with high concurrency and verify found parameters

x8 --url https://example.com/ https://4rt.one/ --workers 0 -c 3 --verifyIdentify

Save request and response data for found parameters to a directory

x8 --url https://example.com/ --wordlist path/to/wordlist.txt --save-responses path/to/output_directoryIdentify