1: Fuzz for the path but add ?FUZZ=1 after the URL where FUZZ is what you will replace for example wfuzz -w wordlist/parameters.txt https://labs.hackxpert.com/Fuzzing/Parameter_bruteforce/01.php?FUZZ=1 I was looking for DeviceType 2: I expect you to make a wordlist of things you would mark likely to be the thing expected. In this case it should be an id which has been pointed out, combined with user makes userID=