Arjun

Arjun

HTTP parameter discovery for hidden GET/POST/JSON/XML attack surface expansion.

Pre-Flight (real usage)

# Confirm installed version and available options
arjun --help

# Start with one endpoint and explicit auth context before batch mode.
# Hidden params are often role-dependent (guest vs user vs admin).

Quick Start

pip3 install arjun

# GET parameters
arjun -u "https://target.com/search"

# POST parameters
arjun -u "https://target.com/search" -m POST

# JSON API
arjun -u "https://api.target.com/user" -m JSON

# Batch scan from file
arjun -i urls.txt -oJ params.json

Core Flags

Common Workflows

# Authenticated GET scan
arjun -u "https://target.com/profile" \
    --headers "Cookie: session=abc123" \
    --include "csrf_token=XYZ"

# POST + save results
arjun -u "https://target.com/api/update" -m POST \
    --headers "Authorization: Bearer TOKEN" \
    -oJ post_params.json

# JSON API discovery
arjun -u "https://api.target.com/v2/user" -m JSON \
    --headers "Authorization: Bearer TOKEN\nX-API-Version: 2"

# Batch scan with rate limit (bug bounty / not-your-server)
arjun -i targets.txt -d 1 --rate-limit 3 -oJ all_params.json

# Passive discovery (stealthy, no active requests)
arjun --passive target.com

# Feed to ffuf for fuzzing
arjun -u "https://target.com/page" -oT params.txt
cat params.txt | while read p; do
    ffuf -u "https://target.com/page?$p=FUZZ" -w payloads.txt -fc 404
done

Real-Tool Workflow (recommended)

1. Run Arjun on a single endpoint in the correct auth state.
2. Save JSON output (-oJ) as source of truth.
3. Replay discovered params with benign values and compare baseline response.
4. Only then escalate to SQLi/XSS/IDOR fuzz payloads.
5. Repeat after privilege/context changes (user role, tenant, feature flag).

Reconnaissance Pipeline

# Full recon → parameter discovery → injection testing
subfinder -d target.com | httpx -silent > live_hosts.txt
cat live_hosts.txt | while read url; do
    arjun -u "$url" -oJ /tmp/params_$(echo $url | md5sum | cut -c1-8).json
done

# Discovered params → sqlmap
arjun -u "https://target.com/search" -oJ params.json
# Use params as --data to sqlmap

# Discovered params → dalfox XSS scan
arjun -u "https://target.com/search" -oT params.txt
cat params.txt | xargs -I{} dalfox url "https://target.com/search?{}=FUZZ"

# Discovered params → ffuf value fuzzing
arjun -u "https://target.com/search" -oT params.txt
cat params.txt | while read p; do
    ffuf -u "https://target.com/search?$p=FUZZ" -w values.txt -mc all -fc 404
done

Passive Mode

# Collect historical params without touching target
arjun --passive target.com

# Good for: stealth recon, bug bounty programs with strict scope
# Sources: Wayback Machine, CommonCrawl, OTX

Arjun vs Param Miner

Practical Triage Tips

• Confirm discovered parameters with at least two payload classes (benign + malicious) before escalation.
• Prioritize parameters that alter response size/status/body structure.
• Re-run Arjun after authentication-state changes (guest vs user vs admin) to detect role-dependent parameters.
• Keep batch scans rate-limited on production targets to avoid noisy false negatives from temporary blocking.
• Treat every discovered parameter as candidate input sink, not immediate vulnerability.

Resources