# Arjun: discovering hidden HTTP parameters

> How to install and run Arjun, and why undocumented parameters are where authorisation logic tends to break.

`Arjun` finds HTTP parameters an endpoint accepts but does not advertise. It sends candidate parameter names and watches for changes in response length, status or content that indicate the application noticed. Hidden parameters are disproportionately interesting because they are the ones nobody wrote tests or authorisation checks for.

## Install

```bash
pipx install arjun
# or
pip install arjun
```

## Core commands

```bash
# GET parameters on one endpoint
arjun -u https://example.com/api/v1/user

# POST with a JSON body
arjun -u https://example.com/api/v1/user -m JSON

# a list of endpoints
arjun -i endpoints.txt -oJ arjun.json

# your own wordlist — use the one unfurl produced
arjun -u https://example.com/api/v1/user -w params.txt

# throttle and authenticate
arjun -u https://example.com/api/v1/user -d 2 --headers "Authorization: Bearer TOKEN"
```

## Output

```json
{"https://example.com/api/v1/user":{"params":["debug","user_id","is_admin"],"method":"GET"}}
```

## Where it sits in Tandera

Arjun runs in the **analyze** phase of `recon_web_full` and `recon_api`. It consumes the endpoint list that `katana` and `linkfinder` produced and the parameter vocabulary `unfurl` extracted from the URL corpus.

In `recon_api` it feeds the shadow-endpoint synthesis: parameters discovered on documented endpoints, compared against the API specification, are how undocumented surface gets identified.

## Using it in a pentest

**Use the application's own vocabulary.** Generic wordlists find `debug` and `test`. `unfurl -u keys` over the archived URL corpus finds `acct_ref` and `tenant_override`, which are the ones that matter.

**`is_admin`, `role`, `debug` and `impersonate` are the jackpot.** A hidden parameter that changes an authorisation decision is a critical, not an information disclosure. Test what it does before you rate it.

**Throttle it.** Arjun sends a lot of requests quickly. `-d 2` puts a delay between them; without it you will trip rate limits and get false negatives, and you may generate an incident on the client side.

**Confirm by hand.** Detection is heuristic — based on response deltas. Reproduce every parameter manually before it reaches the report.

---

Canonical: https://tandera.io/tools/arjun
This page as markdown: https://tandera.io/tools/arjun.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.