Our take
Maintaineda few commits in the last 90 days- Activity
- 30
- Community
- 47
- Issues
- 21
- Pull requests
- 21
Param Miner is a focused Burp extension with recent maintenance activity, but its release history and concentrated contributor base are worth considering before relying on it as a long-term team dependency.
Good fit if
- You already use Burp Suite and need to discover hidden request inputs during web security testing.
- You are investigating web cache poisoning and can tune the extension's traffic workload.
- You can work with the extension's current release and verify findings within your own testing process.
Look elsewhere if
- You need a tool independent of Burp Suite or cannot use a Java-based extension.
- Your adoption policy requires a clearly declared license, since the repository reports no asserted license.
- You need frequent releases or broad contributor ownership, as no release was published in the past year and most contributions come from one person.
All health signals
| Last commit | 2026-08-13 (2 months ago) |
|---|---|
| Commits, last 90 days | 2 |
| Releases, last 12 months | 0 (latest v1.51, 2024-09-09) |
| Contributors | 31 (top contributor: 80% of commits) |
| Issues closed, last 90 days | 0 |
| Pull requests merged, last 90 days | 0 |
| Project age | 8 years |
Checked on 2026-10-27 with the GitHub API.
Overview
Param Miner is a Java extension for PortSwigger Burp Suite that finds hidden, unlinked parameters in web requests. It is aimed at web security testers who need to discover inputs that an application does not expose in its interface, especially when investigating web cache poisoning.
The extension guesses parameter names using a built-in wordlist and words collected from in-scope traffic. Its diffing and binary-search techniques help distinguish meaningful responses from noise. You can run it against selected requests or enable mining across in-scope traffic.
Key Features
- Guesses hidden request parameters, headers, and cookies from Burp requests.
- Uses a curated wordlist and harvests additional candidate words from in-scope traffic.
- Applies response-diffing logic to identify likely effects of guessed inputs.
- Supports attacks on multiple selected requests using a thread pool.
- Can automatically mine in-scope traffic, with settings available to tune its workload.
- Reports findings as scanner issues in Burp Suite Professional, or in the extension's output tab.
- Supports custom wordlists and fuzz-based detection, according to the changelog.
Use Cases
- A penetration tester can search for undocumented headers that might influence caching or application behavior.
- A web security team can investigate whether unlinked parameters create a cache-poisoning condition.
- An assessor can run guesses across a batch of captured requests instead of testing each request manually.
- A tester without Burp Suite Professional can still review discovered parameters in the extension output.
What you need
Detected in the repository
- Java (JVM) (from Gradle)
Getting Started
Install Param Miner from Burp Suite's BApps tab. It requires Burp Suite 2021.9 or later. For build instructions and usage details, see the README.
License in Plain Words
No standard license was detected. Without a license, the default copyright rules apply: you may read the code, but not reuse it. Check the repository or ask the authors.
Considerations
The project is marked as maintained and has had a few commits recently, but it has had no releases in over a year. Its contributor activity is concentrated in one person, and no issues or pull requests were closed in the measured recent period. The repository does not assert a license, so check whether its terms meet your organization's requirements before adopting or redistributing it. Automatic mining can also affect performance at scale and may require tuning.
Found this useful?
Share it with someone who would like param-miner.