{"name":"param-miner: Find Hidden Web Parameters in Burp Suite","description":"Param Miner is a Java extension for PortSwigger Burp Suite that discovers hidden, unlinked parameters in web requests. It helps security testers investigate web cache poisoning and other behaviors triggered by unexpected headers, cookies, or parameters.","github":"https://github.com/PortSwigger/param-miner","url":"https://osrepos.com/repo/portswigger-param-miner","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/portswigger-param-miner","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/portswigger-param-miner.md","json":"https://osrepos.com/repo/portswigger-param-miner.json","topics":["security","java","browser-extension","web-cache-poisoning","parameter-discovery"],"keywords":["security","java","browser-extension","web-cache-poisoning","parameter-discovery"],"stars":null,"summary":"Param Miner is a Java extension for PortSwigger Burp Suite that discovers hidden, unlinked parameters in web requests. It helps security testers investigate web cache poisoning and other behaviors triggered by unexpected headers, cookies, or parameters.","content":"## Overview\n\nParam Miner is a Java extension for PortSwigger Burp Suite that finds hidden, unlinked parameters in web requests. It is aimed at web security testers who need to discover inputs that an application does not expose in its interface, especially when investigating web cache poisoning.\n\nThe extension guesses parameter names using a built-in wordlist and words collected from in-scope traffic. Its diffing and binary-search techniques help distinguish meaningful responses from noise. You can run it against selected requests or enable mining across in-scope traffic.\n\n## Key Features\n\n- Guesses hidden request parameters, headers, and cookies from Burp requests.\n- Uses a curated wordlist and harvests additional candidate words from in-scope traffic.\n- Applies response-diffing logic to identify likely effects of guessed inputs.\n- Supports attacks on multiple selected requests using a thread pool.\n- Can automatically mine in-scope traffic, with settings available to tune its workload.\n- Reports findings as scanner issues in Burp Suite Professional, or in the extension's output tab.\n- Supports custom wordlists and fuzz-based detection, according to the changelog.\n\n## Use Cases\n\n- A penetration tester can search for undocumented headers that might influence caching or application behavior.\n- A web security team can investigate whether unlinked parameters create a cache-poisoning condition.\n- An assessor can run guesses across a batch of captured requests instead of testing each request manually.\n- A tester without Burp Suite Professional can still review discovered parameters in the extension output.\n\n## Our Take\n\nParam Miner is a focused Burp extension with recent maintenance activity, but its release history and concentrated contributor base are worth considering before relying on it as a long-term team dependency.\n\n**Good fit if:**\n- You already use Burp Suite and need to discover hidden request inputs during web security testing.\n- You are investigating web cache poisoning and can tune the extension's traffic workload.\n- You can work with the extension's current release and verify findings within your own testing process.\n\n**Look elsewhere if:**\n- You need a tool independent of Burp Suite or cannot use a Java-based extension.\n- Your adoption policy requires a clearly declared license, since the repository reports no asserted license.\n- You need frequent releases or broad contributor ownership, as no release was published in the past year and most contributions come from one person.\n\n## Project Health\n\n| Signal | Value |\n|---|---|\n| Status | **Maintained**: a few commits in the last 90 days |\n| Last commit | 2026-08-13 (2 months ago) |\n| Commits, last 90 days | 2 |\n| Releases, last 12 months | 0 (latest v1.51, 2024-09-09) |\n| Contributors | 31 (top contributor: 80% of commits) |\n| Issues closed, last 90 days | 0 |\n| Pull requests merged, last 90 days | 0 |\n| Project age | 8 years |\n\nChecked on 2026-10-27 with the GitHub API.\n\n## Project Facts\n\n- Language: Java\n- Stars: 1.5k\n- Forks: 184\n- Topics: extension\n- Website: https://portswigger.net/blog/practical-web-cache-poisoning\n- Archived: no\n\n## What You Need\n\nDetected in the repository:\n\n- Java (JVM) (from Gradle)\n\n## Getting Started\n\nInstall Param Miner from Burp Suite's BApps tab. It requires Burp Suite 2021.9 or later. For build instructions and usage details, see the [README](https://github.com/PortSwigger/param-miner#readme).\n\n## License in Plain Words\n\nNo standard license was detected. Without a license, the default copyright rules apply: you may read the code, but not reuse it. Check the repository or ask the authors.\n\n## Considerations\n\nThe project is marked as maintained and has had a few commits recently, but it has had no releases in over a year. Its contributor activity is concentrated in one person, and no issues or pull requests were closed in the measured recent period. The repository does not assert a license, so check whether its terms meet your organization's requirements before adopting or redistributing it. Automatic mining can also affect performance at scale and may require tuning.","metrics":{"detailViews":0,"githubClicks":0},"dates":{"published":null,"modified":"2026-10-27T04:34:21.000Z"}}