parasort 5.1.0__tar.gz

parasort-5.1.0/CHANGELOG.md

@@ -0,0 +1,136 @@
+# Changelog
+
+All notable changes to Parasort are documented in this file.
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [5.1.0] - 2026-09-13
+
+### Added
+- **Tests + CI**: `tests/` pytest suite (37 tests: core, processing, CLI,
+  incl. short-form convention coverage) and `.github/workflows/ci.yml` matrix
+  across Python 3.11–3.14 (`pytest`, `build`, `twine check` gate);
+  `pip install -e ".[test]"` support.
+- **Streaming input + `-mx` / `--max-urls`**: input files are read line-by-line
+  (no giant intermediate lists); aborts with a clear error when stdin+file
+  input exceeds INT URLs.
+- **JSONL + stdout mode**: `-f jsonl` writes a single `urls.jsonl`
+  (`{"domain","category","url"}` per line); `-o -` / `-st` / `--stdout` streams
+  those records to stdout (human output goes to stderr), e.g.
+  `parasort -i urls.txt -o - | nuclei -l /dev/stdin`.
+- **CSV split** (`-cs` / `--csv-split`): `single` (default, one `urls.csv`) or
+  `per-domain` (one `urls.csv` per domain folder with `category,url` columns).
+- **Normalized dedup** (`-ddn` / `--dedup-normalized`): collapse URLs with
+  identical (domain, path, param-name set), ignoring order/case/values
+  (`?id=1&a=2` vs `?A=2&ID=1`); runs after exact `-dd`.
+- **Live-check upgrade**: `-m` / `--method auto` (default, HEAD first with GET
+  fallback) / `head` / `get`; `-rt` / `--retries 0-10`; `-is` /
+  `--include-status` extra live codes (e.g. `403 404`, evaluated even on HTTP
+  errors); `-lc` / `--live-cache FILE` with `-ct` / `--cache-ttl` (default
+  86400s) persists results across runs; each unique URL is probed once per run
+  (duplicates preserved in output).
+- **Config management**: `--init-config` (`-ic`, create if missing) and
+  `--reset-config` (`-rc`, overwrite with built-in defaults); validation now
+  keeps valid categories and prints per-category warnings instead of rejecting
+  the whole file; `ParaSort.builtin_defaults()` / `reset_config()` API.
+- **Short + long forms**: every new flag follows the project convention
+  (`-st`, `-mx`, `-ddn`, `-cs`, `-m`, `-rt`, `-is`, `-lc`, `-ct`, `-ic`, `-rc`).
+
+## [5.0.1] - 2026-09-13
+
+### Fixed
+- `normalize_parameter`: decode until stable (up to 5x, fixes triple-encoding),
+  strip repeated `[]` and single `[..]` suffixes (`id[][]` -> `id`, `id[0]` -> `id`,
+  `user[name]` -> `user`).
+- `get_domain_from_url`: reject whitespace/garbage hostnames (`"not a url %%%"`
+  -> `unknown_domain`), strip trailing dots, validate labels.
+- `dedup_urls`: strip whitespace in output too (previously kept `" url "` verbatim).
+- `param_signature` / `-uq`: param-less or fully-excluded URLs no longer collapse
+  to one (empty signature returns `None` = keep).
+- `compare_versions`: pre-release sorts lower (`5.0.0b1 < 5.0.0`), so beta -> release
+  triggers `--update`.
+- `fetch_latest_version`: tries `main` then `master` branch.
+- `perform_update`: fixed inverted `capture_output` (silent no longer spams).
+- `load_custom_params_from_file`: strips inline `#` comments (`api_key # prod`
+  -> `api_key`).
+- `-vl` / `-lp`: case-insensitive (`-vl SQLI`, `-lp SQLI` work); `-vl all sqli`
+  warns and expands to all.
+- `-cp ","`: warns instead of silently ignoring.
+- `--timeout` message/help: `>0 and <=300` (code already allowed `0.5`).
+- Parameter tracking/extraction normalized to lowercase (`ID` and `id` no longer
+  listed separately).
+- `show_categories`: trailing `...` only when >5 params.
+- `_validate_config`: empty category lists allowed; entries stripped.
+- `filter_live_urls`: duplicate URLs preserve first-seen order.
+- `--no-color` pre-scan no longer triggers on values (e.g. `-cp` values).
+- `LICENSE`: holder/year normalized to `2025-2026 Ev3rPalestine`.
+- `README`: fixed `Paramters` typo.
+
+## [5.0.0] - 2026-09-12
+
+### Added
+- **Deduplication** (`-dd` / `--dedup`): drop exact duplicate URLs before processing.
+- **Unique params** (`-uq` / `--unique-params`): keep one URL per parameter-name set per domain
+  (e.g. `?id=1` and `?id=2` collapse to the first seen).
+- **Output formats** (`-f` / `--format`): `txt` (default, per-domain `*-urls.txt`),
+  `json` (per-domain `.json` + `summary.json`) and `csv` (single `urls.csv`).
+- **Category profiles** (`-pf` / `--profile`): `web`
+  (sqli, xss, ssrf, lfi, open_redirect) and `api`
+  (sqli, auth_bypass, business_logic, info_disclosure, command_injection, ssrf).
+  An explicit `-vl` / `--vuln` overrides the profile.
+- **Filters**: `-ed` / `--exclude-domain` (exact or `*` wildcard, case-insensitive) and
+  `-xp` / `--exclude-param` (ignored for matching and extraction).
+- **Top-N** (`-tp` / `--top`): keep only the first INT URLs per category per domain.
+- **Live-host check** (`-hc` / `--status-check`): keep only URLs responding HTTP 2xx-3xx
+  (concurrent requests, stdlib only) with configurable `-to` / `--timeout` (>0 and <=300s).
+- **Info commands**: `-lp` / `--list-params` (list a category's parameters),
+  `-V` / `--version`, `-up` / `--update` (self-update via pip, PyPI first with GitHub fallback).
+- **Packaging**: `pyproject.toml` (PEP 517/621 metadata, single-sourced version),
+  `MANIFEST.in`, `.gitignore`; PyPI-ready (`pip install parasort`).
+- **Severity ordering**: categories are now ordered by severity in verbose output and
+  JSON/CSV writers.
+
+### Changed
+- **Every CLI argument now has both a short and a long form**
+  (e.g. `-c` / `--clear`, `-nc` / `--no-color`, `-vl` / `--vuln`).
+- `--vuln` accepts custom categories added via `parameter_categories.json`
+  (previously hardcoded choices rejected them).
+- Minimum Python version is now **3.11+** (was 3.6+).
+- `setup.py` is now a thin shim; all metadata lives in `pyproject.toml`.
+- `--update` upgrades from PyPI first (`pip install --upgrade parasort`),
+  falling back to the GitHub URL.
+- Global summary notes that a URL matching N categories is counted in each.
+
+### Fixed
+- Domain extraction broke on credentials (`user:pass@host` returned `user`),
+  IPv6 (`[::1]:8080` returned `[`), uppercase hosts (duplicate folders) and
+  scheme-less URLs (`example.com/?id=1` went to `unknown_domain`).
+  Now uses `hostname` with lowercasing and scheme-less fallback.
+- `normalize_parameter` mangled names containing `amp;` mid-string
+  (e.g. `exampleamp;test`); now strips only a leading `amp;` artifact,
+  double-decodes, and strips PHP `id[]` suffixes.
+- `clear_parameters` collapsed `?id=1&id=2` to a single `?id=`; now preserves
+  order and duplicates (`?id=&id=`).
+- Per-category parameter tracking recorded *every* URL param under *each*
+  matched category; now only genuinely matching params are recorded, and
+  `uncategorized` params are tracked too.
+- Nested output dirs (`-o a/b/c`) crashed; output dir creation is now
+  `parents=True` inside the error-handled path (a file path returns `False`).
+- Missing input file combined with stdin was silently ignored; now warns and
+  continues with stdin URLs.
+- `-cp "a,b" c` (mixed comma + space) left `'a,b'` unsplit so it never matched;
+  commas are now split in every element.
+- Indented `# comments` in custom-param files were treated as parameters.
+- `--no-color` only cleared `Fore` (leaving `Back`/`Style`) and never applied to
+  help text; now clears all three and is pre-scanned before help rendering.
+- Bare config filenames, invalid JSON and malformed configs no longer crash or
+  spam silent mode; config structure is validated.
+- `all-parameters.txt` is now written for single-domain runs too.
+- Output file handles are always closed (`try/finally`), even on errors.
+- `README.md` installation/arguments sections updated; fixed
+  `custom-urls.txt` vs `custom-params-urls.txt` mismatch.
+
+## [1.5.0] - 2025-08-01
+- Baseline release: URL categorization by vulnerability type, domain-based output,
+  parameter extraction (`-ep`), custom parameters (`-cp` / `-cpf`), value clearing
+  (`--clear`), verbose/silent modes, file + stdin input, JSON config in `~/.parasort/`.

parasort-5.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 Ev3rPalestine
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

parasort-5.1.0/MANIFEST.in

@@ -0,0 +1,2 @@
+include README.md CHANGELOG.md LICENSE parameter_categories.json requirements.txt
+recursive-include tests *.py

parasort-5.1.0/PKG-INFO

@@ -0,0 +1,458 @@
+Metadata-Version: 2.4
+Name: parasort
+Version: 5.1.0
+Summary: URL Parameter Categorization and Extraction Tool for Penetration Testing
+Author-email: Ev3rPalestine <Ev3rPalestine@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/Ev3rPalestine/Parasort
+Project-URL: Repository, https://github.com/Ev3rPalestine/Parasort
+Project-URL: Issues, https://github.com/Ev3rPalestine/Parasort/issues
+Keywords: pentesting,bug-bounty,security,url,parameters,sqli,xss
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Internet :: WWW/HTTP
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: colorama>=0.4.6
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Dynamic: license-file
+
+# Parasort - URL Parameter Categorization & Extraction Tool
+
+![PARASORT Logo](https://img.shields.io/badge/PARASORT-URL%20Parameter%20Categorizer-blue)
+![Python](https://img.shields.io/badge/Python-3.11%2B-green)
+![License](https://img.shields.io/badge/License-MIT-yellow)
+![Author](https://img.shields.io/badge/Author-Ev3rPalestine-orange)
+
+```text
+██████╗  █████╗ ██████╗  █████╗ ███████╗ ██████╗ ██████╗ ████████╗
+██╔══██╗██╔══██╗██╔══██╗██╔══██╗██╔════╝██╔═══██╗██╔══██╗╚══██╔══╝
+██████╔╝███████║██████╔╝███████║███████╗██║   ██║██████╔╝   ██║
+██╔═══╝ ██╔══██║██╔══██╗██╔══██║╚════██║██║   ██║██╔══██╗   ██║
+██║     ██║  ██║██║  ██║██║  ██║███████║╚██████╔╝██║  ██║   ██║
+╚═╝     ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝ ╚═════╝ ╚═╝  ╚═╝   ╚═╝
+URL Parameter Categorizer & Extraction
+by Ev3rPalestine
+```
+
+#### A powerful Python tool for automatically categorizing URLs by their parameters & extracting them to streamline penetration testing and vulnerability assessment workflows.
+
+## Features
+
+- **Automatic URL Categorization**: Sort URLs by vulnerability type (SQLi, XSS, SSRF, LFI, etc.)
+- **Domain-Based Organization**: Output organized by domain folders
+- **Parameters Extraction**: Extract found parameters in urls for fuzzing or other use
+- **Custom Parameter Search**: Support for custom parameters via command line or file
+- **Parameter Value Clearing**: Clean URLs by keeping only parameter names
+- **Flexible Category Selection**: Choose specific vulnerability types, or use `web` / `api` presets
+- **Dedup & Unique-Params**: Drop exact duplicates (`-dd`), normalized duplicates ignoring order/case/values (`-ddn`), or collapse same-param-set URLs (`-uq`)
+- **Filters**: Exclude domains (`-ed`, supports `*` wildcards) and noisy params (`-xp`)
+- **Top-N Focus**: Keep only the first INT URLs per category per domain (`-tp`)
+- **Input Guard**: Abort oversized runs with `--max-urls`
+- **Live-Host Check**: Keep only live URLs (`-hc`, HEAD-first with GET fallback, `--retries`, `--include-status`, persistent `--live-cache`)
+- **Multiple Output Formats**: Classic `txt`, machine-readable `json`, flat `csv` (single or per-domain via `--csv-split`), or pipe-friendly `jsonl` / stdout (`-o -`, `--stdout`)
+- **Self-Updating**: Upgrade to the latest release with `parasort --update`
+- **Configurable Parameters**: External JSON configuration (`--init-config`, `--reset-config`), per-category validation warnings
+- **Tested**: pytest suite (36 tests) + CI matrix across Python 3.11–3.14
+- **Colorful Output**: Visual feedback with color-coded categories
+
+## Installation
+
+### Prerequisites
+- Python 3.11 or higher
+- pip package manager
+
+### From PyPI (recommended)
+
+```bash
+pip install parasort
+```
+
+Isolated install with [pipx](https://pipx.pypa.io/):
+
+```bash
+pipx install parasort
+```
+
+Upgrade to the latest release:
+
+```bash
+pip install --upgrade parasort
+# or: parasort --update
+```
+
+### From source
+
+```bash
+git clone https://github.com/Ev3rPalestine/Parasort.git
+cd Parasort
+pip install .
+```
+## Example
+
+```bash
+# parasort -i urls.txt
+
+
+██████╗  █████╗ ██████╗  █████╗ ███████╗ ██████╗ ██████╗ ████████╗
+██╔══██╗██╔══██╗██╔══██╗██╔══██╗██╔════╝██╔═══██╗██╔══██╗╚══██╔══╝
+██████╔╝███████║██████╔╝███████║███████╗██║   ██║██████╔╝   ██║   
+██╔═══╝ ██╔══██║██╔══██╗██╔══██║╚════██║██║   ██║██╔══██╗   ██║   
+██║     ██║  ██║██║  ██║██║  ██║███████║╚██████╔╝██║  ██║   ██║   
+╚═╝     ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝ ╚═════╝ ╚═╝  ╚═╝   ╚═╝   
+                    URL Parameter Categorizer & Extraction
+                         by Ev3rPalestine
+    
+Processing 858 URLs using 9 categories...
+Processing: example.com
+Processing: example.org
+Processing: example2.com
+
+==================================================
+PROCESSING COMPLETE
+==================================================
+URLs processed: 858
+Domains found: 22
+
+GLOBAL CATEGORY SUMMARY
+--------------------------------------------------
+  uncategorized      :   641 URLs
+  xss                :   122 URLs| Parameters: AdvertiserID, _charset_, _gl, belboon, dclid ... (+33 more)
+  info_disclosure    :    66 URLs| Parameters: v
+  sqli               :    21 URLs| Parameters: _charset_, cnt, groupId, id, k ... (+13 more)
+  business_logic     :     8 URLs| Parameters: actionId, advancePaymentId, backLink, calcType, carModel ... (+25 more)
+  ssrf               :     7 URLs| Parameters: id, image, k, limit, offset ... (+5 more)
+  lfi                :     6 URLs| Parameters: ANAME, FNAME, LAF_PARTNER, Page, action ... (+9 more)
+  open_redirect      :     6 URLs| Parameters: id, k, limit, offset, p_l_id ... (+4 more)
+==================================================
+Output directory: results/
+
+```
+
+## Available Arguments
+```text
+INPUT / OUTPUT:
+  -i, --input FILE      Input file containing URLs (optional if using stdin)
+  -o, --output DIR      Output directory (default: results); use - for stdout JSONL
+  -f, --format FORMAT   Output format: txt (per-domain *-urls.txt),
+                        json (per-domain .json + summary.json),
+                        csv (urls.csv, see -cs) or
+                        jsonl (single urls.jsonl) (default: txt)
+  -st, --stdout         Same as -o -: emit JSONL records to stdout (pipe-friendly)
+  -mx, --max-urls INT     Abort with an error if input exceeds INT URLs (no limit by default)
+
+PROCESSING OPTIONS:
+  -c, --clear           Clear parameter values, keep names only (e.g., -c)
+  -v, --verbose         Show detailed processing information (e.g., -v)
+  -s, --silent          Minimal output for scripting (e.g., -s)
+  -nc, --no-color       Disable colored output (e.g., -nc)
+  -ep, --extract-params Extract all parameters to parameters.txt files
+  -dd, --dedup          Drop exact duplicate URLs before processing
+    -ddn, --dedup-normalized
+                        Drop URLs with identical param sets, ignoring
+                        order/case/values (e.g., -ddn)
+  -uq, --unique-params  Keep one URL per param-name set per domain
+  -tp, --top INT          Keep only the first INT URLs per category per domain
+
+VULNERABILITY CATEGORIES:
+  -vl, --vuln CATEGORY [CATEGORY ...]
+                        Vulnerability categories (e.g., -vl sqli xss)
+  -pf, --profile PROFILE
+                        Preset set: web or api (explicit -vl overrides -pf)
+
+CUSTOM PARAMETERS:
+  -cp, --custom-params PARAM [PARAM ...]
+                        Custom parameters (comma or space separated,
+                        e.g., -cp "id,user,cmd" or -cp id user cmd)
+  -cpf, --custom-params-file FILE
+                        File with custom parameters (e.g., -cpf params.txt)
+
+FILTERS:
+  -ed, --exclude-domain DOMAIN [DOMAIN ...]
+                        Skip domains (exact or * wildcard, e.g.,
+                        -ed static.example.com "*.cdn.com")
+  -xp, --exclude-param PARAM [PARAM ...]
+                        Ignore params for matching/extraction
+                        (e.g., -xp "utm_source,fbclid")
+  -cs, --csv-split MODE  CSV layout with -f csv: single writes one top-level
+                        urls.csv (domain,category,url); per-domain writes one
+                        urls.csv per domain folder (category,url) (default: single)
+
+NETWORK:
+  -hc, --status-check   Keep only live URLs (concurrent probes; 2xx-3xx count
+                        as live, see -is) (e.g., -hc)
+  -m, --method METHOD   Live-probe method for -hc: auto is HEAD first with GET
+                        fallback (fastest), head or get (default: auto)
+  -rt, --retries INT      Extra attempts per URL when a probe fails with a network
+                        error, 0-10 (default: 0)
+  -is, --include-status CODE [CODE ...]
+                        Extra HTTP status codes counted as live on top of
+                        2xx-3xx (e.g., -is 403 404)
+  -lc, --live-cache FILE
+                        JSON file caching live-check results across runs;
+                        entries younger than -ct are reused without probing
+                        (e.g., -lc ~/.parasort/live_cache.json)
+  -ct, --cache-ttl SEC  Reuse -lc cache entries younger than SEC seconds
+                        (default: 86400 = 24h)
+
+INFORMATION:
+  -h, --help            Show this help message and exit
+  -sc, --show-categories
+                        List available vulnerability categories
+  -lp, --list-params [CATEGORY]
+                        List parameters of a category (e.g., -lp sqli)
+  -V, --version         Show version and exit
+  -ic, --init-config   Create ~/.parasort/parameter_categories.json with built-in
+                        defaults if missing, print its path, and exit (e.g., -ic)
+  -rc, --reset-config  Overwrite the config file with built-in defaults,
+                        discarding customizations, and exit (e.g., -rc)
+  -up, --update         Update parasort to the latest release via pip
+
+EXAMPLES:
+  Basic usage:
+    parasort -i urls.txt
+    parasort -i urls.txt -o results -f json
+    cat urls.txt | parasort -o results
+
+  Specific vulnerabilities / profiles:
+    parasort -i urls.txt -o results -vl sqli xss
+    parasort -i urls.txt -o results -pf web
+
+  Custom parameters:
+    parasort -i urls.txt -o results -cp "id,user,cmd"
+    parasort -i urls.txt -o results -cpf my_params.txt
+
+  Clean + focus output:
+    parasort -i urls.txt -o results -c -dd -uq -tp 20
+    parasort -i urls.txt -o results -c -ddn -mx 50000
+    parasort -i urls.txt -o results -ed static.example.com "*.cdn.com" -xp "utm_source,fbclid"
+
+  Machine-readable piping:
+    parasort -i urls.txt -o - | nuclei -l /dev/stdin
+    parasort -i urls.txt -f jsonl -o results
+    parasort -i urls.txt -f csv -cs per-domain
+
+  Live hosts only:
+    parasort -i urls.txt -o results -hc -to 8
+    parasort -i urls.txt -o results -hc -m head -rt 2 -is 403 404
+    parasort -i urls.txt -o results -hc -lc ~/.parasort/live_cache.json
+
+  Config:
+    parasort -ic
+    parasort -rc
+
+  Advanced options:
+    parasort -i urls.txt -o results --clear -v
+```
+
+## Basic Usage
+
+```bash
+# Show help with all examples
+parasort -h
+
+# Show categories / version
+parasort -sc
+parasort -V
+
+# Process custom parameters and clearing their values
+parasort -i urls.txt -o results -cp "id,token,api_key,session" -c
+
+# Process with specific vulnerabilities only (or a preset profile)
+parasort -i urls.txt -o results -vl sqli xss -v
+parasort -i urls.txt -o results -pf web
+
+# Clean duplicates and focus output
+parasort -i urls.txt -o results -dd -uq -tp 20
+parasort -i urls.txt -o results -ddn -mx 50000
+
+# Exclude noise, keep machine-readable output
+parasort -i urls.txt -o results -ed "*.cdn.com" -xp "utm_source,fbclid" -f json
+
+# Pipe JSONL straight into other tools
+parasort -i urls.txt -o - | nuclei -l /dev/stdin
+
+# Live hosts with HEAD-first probing and a persistent cache
+parasort -i urls.txt -o results -hc -m auto -rt 2 -lc ~/.parasort/live_cache.json
+
+# Config management
+parasort -ic
+parasort -rc
+
+# Silent mode
+parasort -i urls.txt -o results -s
+```
+
+## Command Line Options
+#### - Input / Output
+
+    -i, --input FILE - Input file containing URLs (optional if using stdin)
+
+    -o, --output DIR - Output directory (default: results); use - for stdout JSONL (pipe-friendly)
+
+    -f, --format FORMAT - Output format: txt, json, csv or jsonl (default: txt)
+
+    -st, --stdout - Same as -o -: emit JSONL records to stdout; human output goes to stderr (pipe-friendly)
+
+    -mx, --max-urls INT - Abort with an error if total input (stdin + file) exceeds INT URLs (no limit by default)
+
+#### - Processing Options
+
+    -c, --clear - Clear parameter values, keep names only
+
+    -v, --verbose - Show detailed processing information
+
+    -s, --silent - Minimal output (for scripting)
+
+    -nc, --no-color - Disable colored output
+
+    -ep, --extract-params - Extract all parameters to parameters.txt files
+
+    -dd, --dedup - Drop exact duplicate URLs before processing
+
+    -ddn, --dedup-normalized - Drop URLs sharing (domain, path, param names), ignoring param order, case and values
+
+    -uq, --unique-params - Keep one URL per param-name set per domain
+
+    -tp, --top INT - Keep only the first INT URLs per category per domain
+
+#### - Vulnerability Categories
+
+    -vl, --vuln CATEGORY - Vulnerability categories (default: all)
+
+        Available: all, sqli, xss, ssrf, lfi, open_redirect, command_injection, auth_bypass, business_logic, info_disclosure
+        (plus any custom categories added via parameter_categories.json)
+
+    -pf, --profile PROFILE - Preset set: web or api (explicit -vl overrides -pf)
+
+#### - Custom Parameters
+
+    -cp, --custom-params PARAM - Custom parameters to search for (comma or space separated)
+
+    -cpf, --custom-params-file FILE - File with custom parameters (one per line)
+
+#### - Filters
+
+    -ed, --exclude-domain DOMAIN - Skip domains (exact or * wildcard, case-insensitive)
+
+    -xp, --exclude-param PARAM - Ignore params for matching/extraction (comma or space separated)
+
+    -cs, --csv-split MODE - CSV layout with -f csv: single writes one top-level urls.csv (domain,category,url); per-domain writes one urls.csv per domain folder (category,url) (default: single)
+
+#### - Network
+
+    -hc, --status-check - Keep only live URLs (concurrent probes; 2xx-3xx count as live, see -is)
+
+    -m, --method METHOD - Live-probe method for -hc: auto is HEAD first with GET fallback (fastest), head or get (default: auto)
+
+    -rt, --retries INT - Extra attempts per URL when a probe fails with a network error, 0-10 (default: 0)
+
+    -is, --include-status CODE - Extra HTTP status codes counted as live on top of 2xx-3xx (e.g., -is 403 404)
+
+    -lc, --live-cache FILE - JSON file caching live-check results across runs; entries younger than -ct are reused without probing
+
+    -ct, --cache-ttl SEC - Reuse -lc cache entries younger than SEC seconds (default: 86400 = 24h)
+
+    -to, --timeout SEC - HTTP timeout in seconds for -hc and -up (default: 10)
+
+#### - Information
+
+    -h, --help - Show help message and exit
+    -sc, --show-categories - List available vulnerability categories
+    -lp, --list-params [CATEGORY] - List parameters of a category (e.g., -lp sqli)
+    -V, --version - Show version and exit
+    -ic, --init-config - Create ~/.parasort/parameter_categories.json with built-in defaults if missing, print its path, and exit
+    -rc, --reset-config - Overwrite the config file with built-in defaults, discarding customizations, and exit
+    -up, --update - Update parasort to the latest release via pip
+
+
+## Output Structure
+
+The tool creates domain-based folders with categorized URL files (txt format):
+
+```bash
+results/
+├── example.com/
+│   ├── sqli-urls.txt
+│   ├── xss-urls.txt
+│   ├── ssrf-urls.txt
+│   ├── custom-params-urls.txt
+│   ├── parameters.txt          
+│   └── uncategorized-urls.txt
+├── target.org/
+│   ├── sqli-urls.txt
+│   ├── xss-urls.txt
+│   ├── parameters.txt          
+│   └── ...
+└── all-parameters.txt   
+```
+
+With `-f json`: each domain gets `<domain>.json` (category → URL list) plus a
+top-level `summary.json` with per-domain and total counts.
+With `-f csv`: a single top-level `urls.csv` (`domain,category,url`), or per-domain
+`urls.csv` files (`category,url`) with `--csv-split per-domain`.
+With `-f jsonl`: a single top-level `urls.jsonl` (one `{"domain","category","url"}`
+record per line). With `-o -` / `--stdout`, those JSONL records go to stdout
+(human output goes to stderr) for piping into other tools.
+`parameters.txt` / `all-parameters.txt` (`-ep`) are always plain-text lists
+(skipped in stdout mode).
+
+## Configuration
+#### - Parameter Categories File
+
+The parameter_categories.json file is created and located in directory named ".parasort" in the home directory of the user, it defines which parameters belong to each vulnerability category. You can customize this file to add or remove parameters:
+
+```json
+{
+  "sqli": ["id", "user_id", "product_id"],
+  "xss": ["q", "search", "query"],
+  "ssrf": ["url", "redirect", "image"],
+  ...
+}
+```
+
+* The file is automatically created on first run if it doesn't exist.
+* The `parameter_categories.json` in this repo is a reference copy of the built-in
+  defaults; PyPI wheels rely on the embedded defaults and create `~/.parasort/parameter_categories.json` at runtime.
+
+
+#### - Adding New Vulnerability Categories
+* Edit parameter_categories.json
+* Add your new category with relevant parameters
+* The tool will automatically detect the new category
+
+#### - Using Custom Parameter Files
+
+Create a text file with one parameter per line:
+
+```text
+api_key
+session_token
+user_id
+admin
+debug
+```
+
+### - License
+
+```text
+This project is licensed under the MIT License - see the LICENSE file for details.
+Author
+
+Note: This tool is intended for legitimate security testing and educational purposes only. Always ensure you have proper authorization before testing any systems.
+```
+
+## Changelog
+
+See [CHANGELOG.md](CHANGELOG.md) for release history. Current version: **5.1.0**.
+