Arjun can find query parameters for URL endpoints. If you don't get what that means, it's okay, read along.

Web applications use parameters (or queries) to accept user input, take the following example into consideration

https://api.example.com/v1/userinfo?id=751634589

This URL seems to load user information for a specific user id, but what if there exists a parameter named admin which when set to True makes the endpoint provide more information about the user?
This is what Arjun does, it finds valid HTTP parameters with a huge default dictionary of 25,890 parameter names.

The best part? It takes less than 10 seconds to go through this huge list while making just 50-60 requests to the target. Here's how.

• Supports GET/POST/POST-JSON/POST-XML requests
• Automatically handles rate limits and timeouts
• Export results to: BurpSuite, text or JSON file
• Import targets from: BurpSuite, text file or a raw request file
• Can passively extract parameters from JS or 3 external sources

You can install arjun with pip as following:

pip3 install arjun

or, by downloading this repository and running

python3 setup.py install

You can also build and run arjun using Docker. Follow these steps:

First, make sure you are in the root directory of the project where the Dockerfile is located. Then, build the Docker image with the following command:

docker build -t arjun-image .

A detailed usage guide is available on Usage section of the Wiki.

Direct links to some basic options are given below:

• Scan a single URL
• Import targets
• Export results
• Use custom HTTP headers

Optionally, you can use the --help argument to explore Arjun on your own.

After building the image, you can run the container with:

docker run --rm -it arjun-image [normal command]

Note The --rm flag ensures that the container is removed after it exits, and -it makes the container interactive, allowing you to use it as a terminal.

If you need to pass specific commands or arguments to arjun, you can do so by appending them to the docker run command. For example:

docker run --rm -it arjun-image -u https://example.com

The parameter names wordlist is created by extracting top parameter names from CommonCrawl dataset and merging best words from SecLists and param-miner wordlists into that.
db/special.json wordlist is taken from data-payloads.