Skip to main content

HTTP parameter discovery suite

Project description


HTTP Parameter Discovery Suite


What's Arjun?

Arjun can find query parameters for URL endpoints. If you don't get what that means, it's okay, read along.

Web applications use parameters (or queries) to accept user input, take the following example into consideration

This URL seems to load user information for a specific user id, but what if there exists a parameter named admin which when set to True makes the endpoint provide more information about the user?
This is what Arjun does, it finds valid HTTP parameters with a huge default dictionary of 10,985 parameter names.

The best part? It takes less than 10 seconds to go through this huge list while making just 20-30 requests to the target. Here's how.

Why Arjun?

  • Supports GET/POST/POST-JSON/POST-XML requests
  • Automatically handles rate limits and timeouts
  • Export results to: BurpSuite, text or JSON file
  • Import targets from: BurpSuite, text file or a raw request file
  • Can passively extract parameters from JS or 3 external sources

Installing Arjun

You can install arjun with pip as following:

pip3 install arjun

or, by downloading this repository and running

python3 install

How to use Arjun?

A detailed usage guide is available on Usage section of the Wiki.

Direct links to some basic options are given below:

Optionally, you can use the --help argument to explore Arjun on your own.


The parameter names wordlist is created by extracting top parameter names from CommonCrawl dataset and merging best words from SecLists and param-miner wordlists into that. special.json wordlist is taken from data-payloads.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

arjun-2.2.1.tar.gz (129.2 kB view hashes)

Uploaded source

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Huawei Huawei PSF Sponsor Microsoft Microsoft PSF Sponsor NVIDIA NVIDIA PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page