You can you Katana passive crawling rather then gau & and -f qurl for only parameterized urls Oneliner: echo 'yousite.com'| katana -passive -pss waybackarchive,commoncrawl,alienvault -f qurl | gf x ss | uro | nuclei -t prsnltemplates/bsqli-time-based.yaml --dast