Arjun

HTTP Parameter Discovery Suite

🔎What is Arjun?

Arjun is a powerful command-line tool used in web security testing. It’s designed to find HTTP parameters (GET & POST) in web applications by fuzzing endpoints. Essentially, it helps bug bounty hunters, penetration testers, and security researchers discover hidden or undocumented parameters that could lead to vulnerabilities like SQLi, XSS, or IDOR.

Arjun is this super handy tool that helps you find hidden query parameters in URL endpoints. Don’t worry if that sounds confusing.

When websites or APIs take input through URLs, they often do it with parameters. For example, you might see something like:

http://example.com/v1/userinfo?id=751634589

This URL shows details about a user with the ID 751634589. But what if there’s a secret parameter like admin=true that, when added, reveals even more sensitive info? That’s where Arjun comes in it automatically tries thousands of possible parameters (like 25,890 of them!) to see which ones the endpoint actually responds to. And the best part? It’s crazy fast it can churn through all those potential parameters in under 10 seconds by only making 50-60 requests. Pretty cool, right?

❓Why use Arjun?

Because many modern applications have hidden parameters that aren’t documented or visible in the front-end but are processed on the server side. Finding them manually is time-consuming. 
Arjun automates this process, helping you:

• Discover attack surface area.
• Save time in reconnaissance.
• Identify parameters others might miss.
• Increase chances of finding critical vulnerabilities.
• Improve coverage in bug bounty or security assessments.

⚙️ Installation

Arjun is written in Python and can be installed easily:

# Clone the repository
git clone https://github.com/s0md3v/Arjun.git
cd Arjun

# Install dependencies (Python 3 required)
pip install -r requirements.txt

# Or install directly using pip
pip install arjun

# Then you can run it with:
python3 arjun.py -h

Note: If you install with pip, you may use arjun directly.

⚡️5 Useful Things You Can Do with Arjun

1️⃣ Find GET parameters on a single URL

arjun -u https://example.com/page.php

This scans the URL for possible GET parameters.

2️⃣ Find POST parameters on a URL

arjun -u https://example.com/submit.php -m POST

Use -m POST to tell Arjun to test POST requests.

3️⃣ Scan multiple URLs from a file

arjun -i urls.txt

Where urls.txt contains one URL per line.

4️⃣ Output results to a file

arjun -u https://example.com/page.php -o found-params.txt

Saves discovered parameters into found-params.txt for later analysis.

5️⃣ Use custom wordlists

arjun -u https://example.com/page.php --get -w custom-wordlist.txt

This lets you test with your own list of parameter names.

What Hidden Parameters Reveal (and Why It Matters)

Hidden parameters are one of the most productive things to hunt for during web testing, because developers often build functionality that never appears in the user interface but still works if you know the right parameter name. Discovering them can expose:

• Debug or admin toggles like debug=true or admin=1 that change application behavior.
• IDOR opportunities, where a parameter such as user_id lets you access another user's data.
• Injection points for SQL injection or cross-site scripting (XSS) that the visible forms never exposed.
• Business logic paths, such as pricing or feature flags, that were never meant to be user-controlled.

In other words, Arjun does not find vulnerabilities directly — it dramatically widens the attack surface you can then test, which is exactly why it fits so early in a testing workflow.

A Practical Workflow Example

Suppose you are testing https://target.tld/profile. You run Arjun to discover parameters, and it reports that the endpoint quietly responds to a view parameter. You then test ?view=admin and ?view=../ and feed the discovered parameter into other tools for injection testing. That single hidden parameter — invisible in the browser — becomes the starting point for several deeper tests.

Use Arjun Responsibly

Arjun sends real requests to the target, so it is active reconnaissance. Only run it against applications you own or are explicitly authorized to test (for example, within a bug bounty program's scope or a signed engagement). Unauthorized scanning can be illegal — see our Terms & Disclaimer.

Frequently Asked Questions

Is Arjun a vulnerability scanner?

No. Arjun discovers hidden HTTP parameters; it does not exploit them. You still need to test the parameters it finds for actual vulnerabilities using other tools and manual analysis.

Will Arjun get me blocked or detected?

It is designed to be efficient (often 50–60 requests instead of thousands), which keeps noise low, but it still generates traffic. Use the --stable option and rate limiting on sensitive targets, and always stay within your authorized scope.

How is Arjun different from a directory brute-forcer like Gobuster?

Directory brute-forcers find hidden paths and files; Arjun finds hidden parameters on a known endpoint. They complement each other in a thorough reconnaissance process.

Related Reading

• XSS-B2: Automating Cross-Site Scripting Detection
• Reconnaissance Methodologies
• Penetration Testing: Finding Vulnerabilities Before Attackers Do

Authoritative References

• Arjun on GitHub
• OWASP Web Security Testing Guide