The tool aids in identifying hidden parameters that could potentially be vulnerable or reveal interesting functionality that may be missed by other testers. Its high accuracy is achieved through line-by-line comparison of pages, comparison of response codes, and reflections.
The documentation that explains every feature can be accessed at https://sh1yo.art/x8docs/. The source of the documentation is located at /docs.md.
bash
x8 -u "https://example.com/" -w <wordlist>
With default parameters:
bash
x8 -u "https://example.com/?something=1" -w <wordlist>
/?something=1 equals to /?something=1&%s
bash
x8 -u "https://example.com/" -X POST -w <wordlist>
Or with a custom body:
bash
x8 -u "https://example.com/" -X POST -b '{"x":{%s}}' -w <wordlist>
%s will be replaced with different parameters like {"x":{"a":"b3a1a", "b":"ce03a", ...}}
bash
x8 -u "https://example.com/" "https://4rt.one/" -W0
bash
x8 -u "https://example.com/" --param-template "user[%k]=%v" -w <wordlist>
Now every request would look like /?user[a]=hg2s4&user[b]=a34fa&...
Sometimes parameters should be encoded. It is also possible:
bash
x8 -u "https://example.com/?path=..%2faction.php%3f%s%23" --encode -w <wordlist>
http
GET /?path=..%2faction.php%3fWTDa8%3Da7UOS%26rTIDA%3DexMFp...%23 HTTP/1.1
Host: example.com
bash
x8 -u "https://example.com" --headers -w <wordlist>
You can also target single headers:
bash
x8 -u "https://example.com" -H "Cookie: %s" -w <wordlist>
You can check the tool and compare it with other tools on the following urls:
https://4rt.one/level1 (GET)
https://4rt.one/level3 (GET)
``` USAGE: x8 [FLAGS] [OPTIONS]
FLAGS: --append Append to the output file instead of overwriting it. -B Equal to -x http://localhost:8080 --check-binary Check the body of responses with binary content types --disable-additional-checks Private --disable-colors --disable-custom-parameters Do not automatically check parameters like admin=true --disable-progress-bar --disable-trustdns Can solve some dns related problems --encode Encodes query or body before making a request, i.e & -> %26, = -> %3D List of chars to encode: ", `, , <, >, &, #, ;, /, =, % -L, --follow-redirects Follow redirections --force Force searching for parameters on pages > 25MB. Remove an error in case there's 1 worker with --one-worker-per-host option. -h, --help Prints help information --headers Switch to header discovery mode. NOTE Content-Length and Host headers are automatically removed from the list --invert By default, parameters are sent within the body only in case PUT or POST methods are used. It's possible to overwrite this behavior by specifying the option --mimic-browser Add default headers that browsers usually set. --one-worker-per-host Multiple urls with the same host will be checked one after another, while urls with different hosts - are in parallel. Doesn't increase the number of workers --reflected-only Disable page comparison and search for reflected parameters only. --remove-empty Skip writing to file outputs of url:method pairs without found parameters --replay-once If a replay proxy is specified, send all found parameters within one request. --strict Only report parameters that have changed the different parts of a page --test Prints request and response -V, --version Prints version information --verify Verify found parameters.
OPTIONS: -b, --body
Example: --body '{"x":{%s}}' Available variables: {{random}} -c
-t, --data-type <data-type>
Available: urlencode, json
Can be detected automatically if --body is specified (default is "urlencode")
-d, --delay <Delay between requests in milliseconds> [default: 0]
-H <headers> Example: -H 'one:one' 'two:two'
--http <http> HTTP version. Supported versions: --http 1.1, --http 2
-j, --joiner <joiner>
How to join parameter templates. Example: --joiner '&'
Default: urlencoded - '&', json - ', ', header values - '; '
--learn-requests <learn-requests-count> Set the custom number of learn requests. [default: 9]
-m, --max <max>
Change the maximum number of parameters per request.
(default is <= 256 for query, 64 for headers and 512 for body)
-X, --method <methods> Multiple values are supported: -X GET POST
-o, --output <file>
-O, --output-format <output-format> standart, json, url, request [default: standart]
-P, --param-template <parameter-template>
%k - key, %v - value. Example: --param-template 'user[%k]=%v'
Default: urlencoded - <%k=%v>, json - <"%k":%v>, headers - <%k=%v>
-p, --port <port> Port to use with request file
--progress-bar-len <progress-bar-len> [default: 26]
--proto <proto> Protocol to use with request file (default is "https")
-x, --proxy <proxy>
--recursion-depth <recursion-depth>
Check the same list of parameters with the found parameters until there are no new parameters to be found.
Conflicts with --verify for now.
--replay-proxy <replay-proxy>
Request target with every found parameter via the replay proxy at the end.
-r, --request <request> The file with the raw http request
--save-responses <save-responses>
Save request and response to a directory when a parameter is found
--split-by <split-by>
Split the request into lines by the provided sequence. By default splits by \r, \n and \r\n
--timeout <timeout> HTTP request timeout in seconds. [default: 15]
-u, --url <url>
You can add a custom injection point with %s.
Multiple urls and filenames are supported:
-u filename.txt
-u https://url1 http://url2
-v, --verbose <verbose> Verbose level 0/1/2 [default: 1]
-w, --wordlist <wordlist>
The file with parameters (leave empty to read from stdin) [default: ]
-W, --workers <workers>
The number of concurrent url checks.
Use -W0 to run everything in parallel [default: 1]
```
Parameters: - samlists - arjun
Headers: - Param Miner
The burpsuite integration is done via the send to extension.
Give a name to the entry and insert the following line into the command:
/path/to/x8 --progress-bar-len 20 -c 3 -r %R -w /path/to/wordlist --proto %T --port %P
You can also add your frequently used arguments like --output-format,--replay-proxy, --recursion-depth, ..
NOTE if the progress bar doesn't work properly --- try to reducing the value of --progress-bar-len.
Switch from Run in background to Run in terminal.
If you encounter issues with font rendering in the terminal, you can adjust the xterm options in Send to Miscellaneous Options. Simply replace the existing content with xterm -rv -fa 'Monospace' -fs 10 -hold -e %C, or substitute xterm with your preferred terminal emulator.
Now you can go to the proxy/repeater tab and send the request to the tool:
In the next dialog, you can modify the command and execute it in a new terminal window.
After executing the command, a new terminal window will appear, displaying the running tool.
NOTE: Starting with v4.0.0, installing via cargo install uses the crate branch instead of main. This branch includes the original reqwest library that performs HTTP normalizations and prevents sending invalid requests. If you want to use the modified reqwest version without these limitations, I recommend installing via the Releases page or building the sources.
Docker
bash
git clone https://github.com/Sh1Yo/x8
cd x8
docker build -t x8 .
Linux
bash
# pacman -Sy x8
bash
git clone https://github.com/Sh1Yo/x8
cd x8
cargo build --release
bash
cargo install x8
Mac
bash
git clone https://github.com/Sh1Yo/x8
cd x8
cargo build --release
bash
cargo install x8
Windows