> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/web-applications/suspicious-parameters.md). # Suspicious Parameters At DEFCON 31, JHaddix and Gunnar presented a talk titled `SusParams` which uncovered research on parameters which are often vulnerable to common vulnerabilities such as SQLi, SSRF, LFI, etc. This page simply breaks down the parameters observed for reference. ### Cross Site Scripting ```bash path admin class atb redirect_uri other utm_source host currency dir title endpoint return_url users cookie state callback militarybranch href e referer password author body status utm_campaign value text search x-forwarded-host a flaw vote pathname user t utm_medium q onclick email what file onignoretag __proto__ data-original description subject action u nickname color language_id auth samlresponse return onmouseover readyfunction where tags cvo_sid target format back term r id url view username sequel type city src p label ctx style html ad_type onerror s issues query c shop redirect ``` ### Server-Side Template Injection ```bash preview activity id name content view template redirect ``` ### Server-Side Request Forgery ``` start path domain source url site view template page show val dest metadata out feed navigation image_host uri next continue host window dir reference filename html to return open port stop validate resturl callback name data ip redirect ``` ### SQL Injection ```bash process string id referer password pwd field view sleep column log token sel select sort from search update pub_group_id row results role table multi_layer_map_list order filter user fetch limit keyword email query c name where number phone_number delete report ``` ### Open Redirect ```bash u redirect_uri failed r referer return_url redirect_url prejoin_data x-forwarded-host continue redir return_to origin redirect_to next host ``` ### IDOR ```bash count key user id extended_data uid2 group team_id data-id no username email account doc uuid profile number user_id edit report order ``` ### File Inclusion ```bash root directory path style folder default-language url platform textdomain document template pg php_path doc type lang token name pdf file etc api app resource-type ``` ### Debug ```bash test reset config shell admin exec load cfg dbg edit root create access disable alter make grant adm toggle execute clone delete enable rename debug modify ``` ### Command Injection ```bash execute dir daemon cli log cmd download ip execute dir daemon cli log cmd download ip upload ``` ### Resources {% embed url="" %} {% embed url="" %}