GO KALI FREE

Arjun

Web Application

Beginnermedium risk

Arjun finds hidden HTTP parameters in web applications. It uses a huge default dictionary and smart techniques to discover parameters not visible in the user interface.

Installation

pip install arjun

Basic Syntax

arjun -u <url>

Quick Facts

Full Name
Arjun
License
MIT
Written In
Python
Platforms
Linux, macOS, Windows
Category
Parameter Discovery
Methods
GET, POST, JSON
First Release
2019
Author
s0md3v

Tool Overview

Arjun is a Python-based HTTP parameter discovery tool that finds hidden parameters in web applications. By systematically testing parameter names from a large built-in wordlist, it identifies parameters that the application accepts but may not be documented or visible in the interface.

Created by s0md3v (the same author as XSStrike), Arjun supports GET, POST, and JSON parameter discovery with multi-threaded scanning for efficiency. It analyzes HTTP response differences to determine parameter acceptance.

Security professionals use Arjun during the reconnaissance phase to expand the attack surface. Hidden parameters may control backend functionality, enable debugging features, or reveal undocumented API endpoints that could contain vulnerabilities.

Common Commands

arjun -u https://example.com/apiScan a single URL for hidden HTTP parameters using the default GET method.
arjun -u https://example.com/api -m GETExplicitly test parameters using GET query strings.
arjun -u https://example.com/api -m POSTFuzz parameters sent in a POST body (application/x-www-form-urlencoded).
arjun -u https://example.com/api -m JSONDiscover parameters inside a JSON request body.
arjun -u https://example.com/api -m XMLDiscover parameters inside an XML request body.
arjun -u https://example.com/api -t 20Increase concurrency to 20 threads for faster scanning.
arjun -u https://example.com/api -d 2Add a 2-second delay between requests to respect rate limits.
arjun -u https://example.com/api -w params.txtUse a custom wordlist of candidate parameter names.
arjun -u https://example.com/api -oT results.txtSave discovered parameters to a plain-text file.
arjun -u https://example.com/api -oJ results.jsonSave results in JSON format for tooling or reporting.
arjun -u https://example.com/api -c 250Set the chunk size (parameters tested per request) to 250.
arjun -u https://example.com/api --headers "User-Agent: Mozilla/5.0"Send custom HTTP headers with every request.
arjun -u https://example.com/api --stableUse the stable (slower, more reliable) detection mode to reduce false positives.
arjun -u https://example.com/api --passivePassive mode: mine parameter names from third-party sources without brute forcing.
arjun -u https://example.com/api -T 10Set the per-request timeout to 10 seconds.

Step-by-Step Guide

  1. 1Identify target endpoint
  2. 2Run arjun
  3. 3Review discovered parameters
  4. 4Test each for vulnerabilities
  5. 5Use with sqlmap/xsstrike

Warnings

Use Cases

Hidden Parameter Discovery

Find undocumented URL parameters that control hidden application functionality.

API Parameter Enumeration

Discover undocumented API parameters for REST and JSON endpoints.

Attack Surface Expansion

Expand the attack surface by finding parameters for vulnerability testing with specialized tools.

Debug Feature Detection

Uncover debug or test parameters left in production applications.

Server-Side Parameter Testing

Find parameters that trigger server-side operations like database queries or file operations.

Wordlist Customization

Build customized parameter wordlists by analyzing discovered parameters across multiple targets.

Related Tools

FFUF

Web Application

Fast web fuzzer for directory discovery, parameter fuzzing, and virtual host enumeration.

Wfuzz

Web Application

Web application fuzzer for brute-forcing parameters, directories, and more.

Gobuster

Web Application

Directory and subdomain brute-forcer for discovering hidden paths and virtual hosts.

Nuclei

Vulnerability Analysis

Fast and customizable vulnerability scanner based on YAML templates.

Parameth

Web Application

Brute-forcing hidden GET and POST parameters in web applications.

Frequently Asked Questions

What is Arjun used for?

Arjun finds hidden HTTP parameters in web applications that are not visible in the user interface. Discovering these parameters expands the attack surface for further vulnerability testing with tools like SQLMap or XSStrike.

How does Arjun discover parameters?

Arjun sends requests with different parameter names from its built-in wordlist and analyzes HTTP response differences (status codes, content length, response content) to determine which parameters are accepted by the application.

Can Arjun find API parameters?

Yes, Arjun is particularly effective for discovering undocumented API parameters. Use -m JSON for JSON API endpoints and -m POST for REST API parameters.

How is Arjun different from directory busters?

Arjun discovers URL parameters (?param=value), not directories. Directory busters like Gobuster find hidden paths (/admin), while Arjun finds hidden parameters accepted by those paths.

What techniques does Arjun use for parameter discovery?

Arjun uses dictionary-based fuzzing, response analysis, and differential testing to identify parameters by analyzing changes in HTTP response codes, content length, and response content.

Can Arjun discover hidden GET parameters?

Yes, Arjun excels at discovering hidden GET parameters by appending parameter names to URLs and analyzing response differences to identify accepted parameters.

Does Arjun support POST parameter discovery?

Yes, Arjun supports POST parameter discovery using the -m POST flag, which sends POST requests with different parameter names to identify hidden form fields.

How does Arjun handle content type fuzzing?

Arjun supports content type fuzzing through JSON mode (-m JSON) which tests for hidden parameters in JSON request bodies used by modern APIs.

Can Arjun use custom wordlists for parameter discovery?

Yes, Arjun supports custom wordlists via the -w flag, allowing you to use application-specific parameter dictionaries for targeted discovery.

Is Arjun suitable for API parameter testing?

Yes, Arjun is particularly effective for API parameter discovery, supporting JSON, POST, and GET methods to find undocumented API endpoints and parameters.

How do I reduce false positives in Arjun?

Use the --stable flag for more reliable results: arjun -u http://target.com/page --stable. This enables more thorough verification of discovered parameters, reducing false positives from dynamic responses.

Can Arjun test URL fragments?

No, Arjun discovers URL query parameters (?param=value), not URL fragments (#fragment). For fragment-based testing, use specialized tools or manual testing approaches.

How do I use Arjun with custom headers?

Use the --headers flag: arjun -u http://target.com/page --headers="Authorization: Bearer token". Arjun sends custom headers with each request while testing for hidden parameters.

Can Arjun detect API versioning parameters?

Yes, Arjun can discover version-related parameters like 'version', 'api_version', 'v1', 'v2'. Use the default wordlist which includes common API parameter names for version discovery.

How do I save Arjun results for later analysis?

Use -o to save results to a JSON file: arjun -u http://target.com/page -o results.json. JSON format includes discovered parameters, HTTP methods, and response analysis for each parameter.

Can Arjun scan multiple URL parameters at once?

Yes, Arjun discovers all hidden parameters on a single URL. For multiple URLs, use -i with a file containing URLs: arjun -i urls.txt. Each URL is tested independently for hidden parameters.

How does Arjun detect parameter acceptance?

Arjun analyzes HTTP response differences including status codes, content length changes, and response body modifications. Parameters that cause consistent response changes are flagged as potentially accepted by the application.

Can Arjun discover cookie parameters?

No, Arjun discovers URL query and POST body parameters, not cookie parameters. For cookie parameter testing, use specialized tools like Burp Suite or custom scripts that modify cookie values.

How do I install or update Arjun?

Install with: pip3 install arjun. Or from GitHub: git clone https://github.com/s0md3v/Arjun.git && cd Arjun && python3 setup.py install. Update with: pip3 install --upgrade arjun.

Tags

#web-application#parameter-discovery#reconnaissance#fuzzing

Output Explanation

Lists discovered parameters with their detected type (GET/POST/JSON).

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.