Arjun: discovering hidden HTTP parameters

Arjun · AGPL-3.0

Arjun finds HTTP parameters an endpoint accepts but does not advertise. It sends candidate parameter names and watches for changes in response length, status or content that indicate the application noticed. Hidden parameters are disproportionately interesting because they are the ones nobody wrote tests or authorisation checks for.

Install

pipx install arjun
# or
pip install arjun

Core commands

# GET parameters on one endpoint
arjun -u https://example.com/api/v1/user

# POST with a JSON body
arjun -u https://example.com/api/v1/user -m JSON

# a list of endpoints
arjun -i endpoints.txt -oJ arjun.json

# your own wordlist — use the one unfurl produced
arjun -u https://example.com/api/v1/user -w params.txt

# throttle and authenticate
arjun -u https://example.com/api/v1/user -d 2 --headers "Authorization: Bearer TOKEN"

Output

{"https://example.com/api/v1/user":{"params":["debug","user_id","is_admin"],"method":"GET"}}

Where it sits in Tandera

Arjun runs in the analyze phase of recon_web_full and recon_api. It consumes the endpoint list that katana and linkfinder produced and the parameter vocabulary unfurl extracted from the URL corpus.

In recon_api it feeds the shadow-endpoint synthesis: parameters discovered on documented endpoints, compared against the API specification, are how undocumented surface gets identified.

Using it in a pentest

Use the application’s own vocabulary. Generic wordlists find debug and test. unfurl -u keys over the archived URL corpus finds acct_ref and tenant_override, which are the ones that matter.

is_admin, role, debug and impersonate are the jackpot. A hidden parameter that changes an authorisation decision is a critical, not an information disclosure. Test what it does before you rate it.

Throttle it. Arjun sends a lot of requests quickly. -d 2 puts a delay between them; without it you will trip rate limits and get false negatives, and you may generate an incident on the client side.

Confirm by hand. Detection is heuristic — based on response deltas. Reproduce every parameter manually before it reaches the report.