otlite · Web and records

Install ParamSpider on Linux or macOS in one command

ParamSpider pulls every archived URL for a domain from the Wayback Machine and keeps the ones with query parameters. The result is a list of endpoints and parameter names without touching the live site.

ParamSpider in three lines

pipx install otlite
otlite install paramspider
otlite run paramspider -- d:example.com

Runs devanshbatham/ParamSpider (MIT, ★ 3.2k, otlite 1.2.1, catalog updated Oct 23, 2026). otlite installs and runs it at a tested version; it does not change or verify the tool itself.

What ParamSpider is for

Passive endpoint discovery before an authorised test.
Finding old parameters a site may still accept.

Typed inputs for ParamSpider

otlite translates these prefixes into ParamSpider's own flags. Anything else after -- is passed through unchanged, so every original flag still works.

d:: Domain · otlite run paramspider -- d:example.com

Run every installed tool that takes the same input at once: otlite run --all d:example.com

Where the results go

Every run lands under ./results/paramspider/<target>/ as a timestamped output file, a .meta.json sidecar (the exact command, start and end time, exit code, and the SHA-256 of the output), and a .envelope.json with the entities found, in the same shape for every tool. List runs with otlite results, group them with --case, compare the last two with otlite diff paramspider <target>, and pull indicators out with otlite extract paramspider.

Before you run it

Installed from the repo's main branch, so otlite update paramspider tracks it.

Update, remove, inspect

otlite info paramspider      # inputs, keys, an example command
otlite example paramspider   # sample output, where there is one
otlite update paramspider    # move to the next tested version
otlite remove paramspider    # delete its virtualenv

Full reference: the otlite docs, and the tool's own README on GitHub.

Pairs with

Sitedorks

Sitedorks builds search-engine queries that look for a term across a curated set of sites, such as paste sites, code hosts, and social networks, and opens them in your browser.

FinalRecon

FinalRecon runs a set of web recon checks against a URL in one go: headers, SSL certificate, WHOIS, crawler, DNS, subdomains, directory search, and a port scan.

theHarvester

theHarvester gathers email addresses, subdomains, IPs, and names for a domain from public sources.

FAQ

ParamSpider with otlite, answered

How do I install ParamSpider on Kali, Ubuntu, or macOS?

Install otlite once with pipx install otlite (or the one-line installer on the otlite page), run otlite init, then otlite install paramspider. The tool lands in its own virtualenv under ~/.otlite/, pinned to a version that was tested, so nothing touches your system Python. otlite doctor prints the command that fixes a missing git or venv module.

Which inputs does ParamSpider take through otlite?

d: (domain). otlite maps each prefix to ParamSpider's own flag. Everything after -- that is not a typed input is passed through unchanged, so the original flags still work.

Where does otlite save ParamSpider results?

Under ./results/paramspider/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar (the exact command, timing, exit code, and SHA-256) and a .envelope.json with the entities found. Add --case <name> to group runs, otlite results to list them, and otlite diff paramspider <target> to compare the last two.

Does ParamSpider need an API key or a login?

No key is required for the basic run. Optional keys, where the project supports them, go in with otlite keys set NAME and are passed only to tools that declare them.

Can I run ParamSpider together with other tools?

Yes. otlite run --all d:example.com runs every installed tool that takes domain input, in parallel, including ParamSpider. Save the combination as a playbook to repeat it.