Arjun
HTTP parameter discovery suite that finds hidden query and POST parameters on web endpoints.
Technical Architecture & Overview
Arjun brute-forces hidden HTTP parameters using a default dictionary of roughly 25,000 parameter names, detecting valid ones through response differentials. It handles GET, POST, and JSON bodies, respects rate limits, and imports targets from Burp Suite, raw request files, or text lists. Hidden parameters frequently expose broken access control and injection paths that scanners skip.
Targeted Technical Use Cases
Endpoint-by-endpoint parameter discovery before injection testing or access control review.
Evaluation & Trade-offs
Core Strengths
- +Large curated parameter dictionary out of the box.
- +Response-differential logic works against most stacks.
- +Fast enough for large URL lists.
Trade-Offs & Limitations
- -Noisy requests can trip WAFs and rate limiters.
- -Finding a parameter says nothing about its impact.
Defensive Security Application
Demonstrating why unlisted parameters need the same validation and authorization as documented ones.
Frequently Asked Questions
What is Arjun?→
Arjun brute-forces hidden HTTP parameters using a default dictionary of roughly 25,000 parameter names, detecting valid ones through response differentials. It handles GET, POST, and JSON bodies, respects rate limits, and imports targets from Burp Suite, raw request files, or text lists. Hidden parameters frequently expose broken access control and injection paths that scanners skip.
What is Arjun used for?→
Endpoint-by-endpoint parameter discovery before injection testing or access control review.
What are the strengths of Arjun?→
- +Large curated parameter dictionary out of the box.
- +Response-differential logic works against most stacks.
- +Fast enough for large URL lists.
What are the limitations of Arjun?→
- +Noisy requests can trip WAFs and rate limiters.
- +Finding a parameter says nothing about its impact.
How is Arjun used defensively?→
Demonstrating why unlisted parameters need the same validation and authorization as documented ones.