Information Gathering

Arjun v1.1 – HTTP Parameter Discovery Suite

November 21, 2018
1 Min Read
Arjun v1.1 - HTTP Parameter Discovery Suite

Features

  • Multi-threading
  • 3 modes of detection
  • Regex powered heuristic scanning
  • Huge list of 3370 parameter names

Usage

Note: Arjun doesn’t work with python < 3.4

Discover parameters
To find GET parameters, you can simply do:

python3 arjun.py -u https://api.example.com/endpoint --get

Similarly, use --post to find POST parameters.

Multi-threading
Arjun uses 2 threads by default but you can tune its performance according to your network connection.

python3 arjun.py -u https://api.example.com/endpoint --get -t 22

Delay between requests
You can delay the request by using the -d option as follows:

python3 arjun.py  -u https://api.example.com/endpoint --get -d 2

Adding HTTP Headers
Using the --headers switch will open an interactive prompt where you can paste your headers. Press Ctrl + S to save and Ctrl + X to procced.

Note: Arjun uses nano as the default editor for the prompt but you can change it by tweaking /core/prompt.py.

Credits
The parameter names list has been taken from @SecLists

 

Tags