aeondave/arjun

Arjun

HTTP parameter discovery for hidden GET/POST/JSON/XML attack surface expansion.

Pre-Flight (real usage)

# Confirm installed version and available options
arjun --help

# Start with one endpoint and explicit auth context before batch mode.
# Hidden params are often role-dependent (guest vs user vs admin).

Quick Start

pip3 install arjun

# GET parameters
arjun -u "https://target.com/search"

# POST parameters
arjun -u "https://target.com/search" -m POST

# JSON API
arjun -u "https://api.target.com/user" -m JSON

# Batch scan from file
arjun -i urls.txt -oJ params.json

Core Flags

| Flag | Purpose | |------|---------| | -u <url> | Target URL | | -i <file> | URL list for batch scanning | | -m <method> | Method: GET / POST / JSON / XML (default: GET) | | -w <wordlist> | Wordlist: path or small / medium / large (default: large) | | -oJ <file> | JSON output (for tool integration) | | -oT <file> | Text output | | -oB [proxy] | Output to Burp proxy (default: 127.0.0.1:8080) | | --headers <h> | Custom headers (newline-separated) | | --include <data> | Include data in every request (cookies, tokens) | | -t <N> | Threads (default: 5) | | -d <s> | Delay between requests (seconds) | | -T <s> | Request timeout (default: 15s) | | --rate-limit <N> | Max requests/second | | --passive [domain] | Collect params from Wayback/CommonCrawl/OTX (no active requests) | | --stable | Prefer stability over speed (unreliable servers) | | --disable-redirects | Don't follow HTTP redirects | | --casing <style> | Parameter casing: like_this / likeThis / likethis | | -c <N> | Chunk size (params sent per request) | | -q | Quiet mode |

Common Workflows

# Authenticated GET scan
arjun -u "https://target.com/profile" \
    --headers "Cookie: session=abc123" \
    --include "csrf_token=XYZ"

# POST + save results
arjun -u "https://target.com/api/update" -m POST \
    --headers "Authorization: Bearer TOKEN" \
    -oJ post_params.json

# JSON API discovery
arjun -u "https://api.target.com/v2/user" -m JSON \
    --headers "Authorization: Bearer TOKEN\nX-API-Version: 2"

# Batch scan with rate limit (bug bounty / not-your-server)
arjun -i targets.txt -d 1 --rate-limit 3 -oJ all_params.json

# Passive discovery (stealthy, no active requests)
arjun --passive target.com

# Feed to ffuf for fuzzing
arjun -u "https://target.com/page" -oT params.txt
cat params.txt | while read p; do
    ffuf -u "https://target.com/page?$p=FUZZ" -w payloads.txt -fc 404
done

Real-Tool Workflow (recommended)

1. Run Arjun on a single endpoint in the correct auth state.
2. Save JSON output (-oJ) as source of truth.
3. Replay discovered params with benign values and compare baseline response.
4. Only then escalate to SQLi/XSS/IDOR fuzz payloads.
5. Repeat after privilege/context changes (user role, tenant, feature flag).

Reconnaissance Pipeline

# Full recon → parameter discovery → injection testing
subfinder -d target.com | httpx -silent > live_hosts.txt
cat live_hosts.txt | while read url; do
    arjun -u "$url" -oJ /tmp/params_$(echo $url | md5sum | cut -c1-8).json
done

# Discovered params → sqlmap
arjun -u "https://target.com/search" -oJ params.json
# Use params as --data to sqlmap

# Discovered params → dalfox XSS scan
arjun -u "https://target.com/search" -oT params.txt
cat params.txt | xargs -I{} dalfox url "https://target.com/search?{}=FUZZ"

# Discovered params → ffuf value fuzzing
arjun -u "https://target.com/search" -oT params.txt
cat params.txt | while read p; do
    ffuf -u "https://target.com/search?$p=FUZZ" -w values.txt -mc all -fc 404
done

Passive Mode

# Collect historical params without touching target
arjun --passive target.com

# Good for: stealth recon, bug bounty programs with strict scope
# Sources: Wayback Machine, CommonCrawl, OTX

Arjun vs Param Miner

| | Arjun | Param Miner (Burp) | |-|-------|--------------------| | Type | CLI / automation | Burp extension | | Wordlist | 25,890 params | 50,000+ | | Batch | Yes (-i) | Per-endpoint | | Output | JSON/text/Burp | Burp only | | Use | Automation, pipelines | Manual testing in Burp |

Practical Triage Tips

• Confirm discovered parameters with at least two payload classes (benign + malicious) before escalation.
• Prioritize parameters that alter response size/status/body structure.
• Re-run Arjun after authentication-state changes (guest vs user vs admin) to detect role-dependent parameters.
• Keep batch scans rate-limited on production targets to avoid noisy false negatives from temporary blocking.
• Treat every discovered parameter as candidate input sink, not immediate vulnerability.

Resources

| File | When to load | |------|--------------| | references/param-discovery.md | Passive discovery, custom wordlists, full recon pipelines, integration patterns |