Hidden Parameter Discovery

What it is

Undocumented request parameters the server accepts but does not advertise, a common home for injection and access bugs.

How attackers abuse it

Left unaddressed, this weakness gives an attacker a foothold they can combine with other issues to reach your data or your users.

Attacker playbook

1. 1Identify where the weakness appears in the app.
2. 2Probe it to confirm the behavior is exploitable.
3. 3Chain it with other findings to increase impact.

How VibeSec detects and confirms it

VibeSec tests for this with an active scan, which runs only on targets you confirm you own or are authorized to test. We detect and confirm it using arjun. When a payload actually proves the issue, it is reported as a confirmed finding rather than a guess.

If this is in your report: how to fix it

• Apply the standard fix for this issue class described in your VibeSec report.
• Validate and constrain all untrusted input.
• Re-scan after fixing to confirm it is resolved.