Arjun

Arjun brute-forces hidden HTTP parameters using a default dictionary of 25,890 parameter names, detecting valid ones through response differentials. It handles GET, POST, JSON, and XML requests, handles rate limits and timeouts, and imports targets from Burp Suite, raw request files, or text lists. Hidden parameters frequently expose broken access control and injection paths that scanners skip.

Endpoint-by-endpoint parameter discovery before injection testing or access control review.

• +Large curated parameter dictionary out of the box.
• +Detects parameters by comparing response length, reflections, and status codes.
• +Its README states it covers the default list in under 10 seconds with 50 to 60 requests.

• +Noisy requests can trip WAFs and rate limiters.
• +Finding a parameter says nothing about its impact.

Demonstrating why unlisted parameters need the same validation and authorization as documented ones.