Map parameters, API methods, objects and writable properties

Needs: A valid request and explicit role/object ownership; exact input format and content type

GET parameter names

# GET parameter names
ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u 'http://TARGET:PORT/PATH?FUZZ=test' -ac -o params-get.json

# POST form parameter names
ffuf -w WORDLIST -u http://TARGET:PORT/PATH -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'known=value&FUZZ=test' -ac -o params-post.json

# Object values with an authenticated API
ffuf -w NUMBERS -u 'http://TARGET:PORT/api/objects/FUZZ' -H 'Authorization: Bearer TOKEN' -mc all -fc 404 -o object-values.json

# ffuf — preserve a captured authenticated request
# HTTPS request, including its original method and session headers
ffuf -request request.txt -request-proto https -w WORDLIST -mc all -ac -t 10 -o request-https.json

# Plain HTTP request: otherwise ffuf defaults to HTTPS
ffuf -request request.txt -request-proto http -w WORDLIST -mc all -ac -t 10 -o request-http.json

Decisive output: a manually reproduced parameter or value that changes application behavior. Tool outliers are candidates, not confirmed access-control flaws.

Read: compare an outlier's status/length/body with a known missing value, then replay that exact request. A login redirect for every value → refresh the session before continuing. A one-time CSRF token → repair token handling; the saved-request flag does not refresh it automatically.

Ffuf — preserve a captured authenticated request

Read: compare an outlier's status/length/body with a known missing value, then replay that exact request. A login redirect for every value → refresh the session before continuing. A one-time CSRF token → repair token handling; the saved-request flag does not refresh it automatically.

# ffuf — preserve a captured authenticated request
curl -ski http://TARGET:PORT/api/v1/PATH
curl -ski -X OPTIONS http://TARGET:PORT/api/v1/PATH
curl -ski -X POST -H 'Content-Type: application/json' -d '{"username":"TEST_USER","password":"TEST_PASSWORD"}' http://TARGET:PORT/api/v1/login

Build a matrix across anonymous, user A, user B and administrator contexts where available

Interpretation: 405 can establish that a route exists but rejects the method. Validation errors can reveal required fields. A token establishes only the authorization demonstrated by a later request.

# Build a matrix across anonymous, user A, user B and administrator contexts where available
PATH | METHOD | IDENTITY/ROLE | OBJECT/PROPERTY | RESULT | NEXT

Verify → Prove which input is consumed and whether state changes persist in an independent read.

If it fails → HTTP 400/415 may indicate encoding/schema rather than security enforcement. Keep a valid request before changing permissions-related properties. More detail ↓

If → then

API objects expose role, ownership or security-sensitive properties → Modify a protected property through excessive writable fields
Needs: The server binds an untrusted property to a persistent security-relevant field without checking permission
A request selects an object by ID/path and two authorized ownership contexts are available → Cross an object-ownership boundary
Needs: The server accepts a lower-privilege identity's request for an object it should not access
An input appears in a command-like operation or causes shell-dependent behavior → Prove visible or blind operating-system command injection
Needs: Input reaches command execution with an exploitable parsing boundary; process identity/runtime can perform the selected proof
Database errors or controlled true/false response differences → Establish SQL query influence and DBMS context
Needs: Input reaches a SQL query; a valid request and stable response baseline exist
Untrusted input reaches an executable HTML/JavaScript context → Execute browser code and validate a useful same-origin action
Needs: Payload reaches a browser execution sink; any useful privileged action additionally needs a victim context, same-origin access and a valid request state
URL import, preview, webhook or fetch behavior → Use server-side requests to inspect reachable internal behavior
Needs: The application server performs a controllable request; destination/protocol policy and its network position permit the selected resource

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Map parameters, API methods, objects and writable properties

USE WHEN: An API/schema, numeric object IDs, hidden fields or different HTTP methods
STARTING ACCESS: A reachable HTTP application and recorded anonymous or authenticated request state
RESULT: A parameter/object/method inventory and testable authorization or injection hypothesis

Recognize the clue

Capture a valid API request, inspect its schema/client code and compare allowed methods and controlled object/role contexts.

curl -sk -i -b cookies.txt http://TARGET:PORT/api/PATH

SYNTHETIC EXAMPLE OUTPUT

Object fields: id, ownerId, role
Observed request: PATCH /api/profile
Body: {"displayName":"VALUE"}

Means: The actual object, method and writable input are known; returned owner/role fields are only candidate security boundaries.

Confirm: Determine field binding, ownership, persistence and server authorization with controlled accounts.

After validation: A protected field/action changes under a lower role and is independently verified: select its authorization method.
Ruled out in this context: The server ignores the sensitive field and privileges remain unchanged: reject that assignment hypothesis.
Still inconclusive: Malformed JSON or wrong content type makes a failed request inconclusive; reproduce the valid update first.

Troubleshooting: HTTP 400/415 may indicate encoding/schema rather than security enforcement. Keep a valid request before changing permissions-related properties.

GET parameter names:

POST form parameter names:

Object values with an authenticated API:

Decisive output: a manually reproduced parameter or value that changes application behavior. Tool outliers are candidates, not confirmed access-control flaws.

ffuf — preserve a captured authenticated request

Save a working raw request from the proxy as request.txt, retain its Host/cookie/body, and put FUZZ at the single parameter name/value or path being tested. Replay it once manually first. The request file does not specify TLS: choose the transport explicitly.

Read: compare an outlier's status/length/body with a known missing value, then replay that exact request. A login redirect for every value → refresh the session before continuing. A one-time CSRF token → repair token handling; the saved-request flag does not refresh it automatically.

ffuf request configuration.

Interpretation: 405 can establish that a route exists but rejects the method. Validation errors can reveal required fields. A token establishes only the authorization demonstrated by a later request.

Build a matrix across anonymous, user A, user B and administrator contexts where available:

Why it works

APIs enforce security at route, object and property boundaries. A valid JSON body can be accepted while a sensitive field is ignored; test its persisted effect separately.

Worked example · hypothetical

Observation: an API response includes a role property. Test: compare documented writable fields and a controlled update. Illustrative output: the field is ignored and privilege is unchanged. Interpretation: that mass-assignment hypothesis is disproven; investigate other boundaries.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗