arjun

Find GET parameters for a URL

$ arjun -u [https://example.com/page]

$ arjun -u [https://example.com/api] -m POST

$ arjun -u [https://example.com] -w [path/to/wordlist.txt]

$ arjun -i [urls.txt]

$ arjun -u [https://example.com/api] -m POST --json

$ arjun -u [https://example.com] --headers "[Cookie: session=abc]"

$ arjun -u [https://example.com] -o [results.txt]

$ arjun -u [https://example.com] -t [20]

arjun [-u url] [-i file] [-m method] [-w wordlist] [-o output] [-t threads] [options]

Arjun is a parameter discovery tool designed for web application security testing. It identifies hidden or undocumented HTTP parameters by sending crafted requests and analyzing responses for differences that indicate valid parameters.
The tool uses a combination of techniques to detect parameters: it monitors response length, status codes, and content changes when different parameter names are submitted. This allows it to find parameters that trigger distinct server behavior, even when the application doesn't explicitly advertise them.
Arjun includes a built-in wordlist of common parameter names but supports custom wordlists for targeted testing. It can discover parameters in GET requests (query strings), POST form data, and JSON bodies. The passive mode queries external sources like web archives and search engines for known parameters.
The tool is commonly used in penetration testing and bug bounty hunting to find attack surface that might be missed during initial reconnaissance. Parameters discovered may reveal hidden functionality, debug modes, or additional attack vectors.

-u, --url url

Target URL to scan for parameters.

File containing URLs to scan (one per line).

HTTP method to use (GET, POST, PUT, DELETE, PATCH). Default: GET.

Custom wordlist for parameter names.

Save results to file.

Number of concurrent threads (default: 2).

Send POST data as JSON instead of form data.

Custom headers in format "Header: value".

Use passive sources to find parameters.

Use more reliable but slower detection.

Delay between requests.

Parameters to always include in requests.

Request timeout.

Suppress output except results.

Should only be used on applications you have permission to test. High thread counts or no delay may trigger rate limiting or WAF blocks. Detection is heuristic-based and may produce false positives/negatives. Large wordlists significantly increase scan time.

Arjun was created by Somdev Sangwan (s0md3v) and released as an open-source security tool. It gained popularity in the bug bounty and penetration testing community for its effectiveness at finding hidden parameters. The tool is written in Python and actively maintained with updates for new detection techniques.

ffuf(1), wfuzz(1), burpsuite(1), httpx(1), paramspider(1)