During a penetration test, you want to discover API endpoints and hidden parameters in a web application. Which tool combination is most effective for this task?