Arjun
HTTP parameter discovery tool.
KaliParrotmedium
pkg: arjun
Arjun finds hidden GET/POST parameters an endpoint accepts — uncovering attack surface for injection.
Syntax
arjun -u {url}
Example
arjun -u https://example.com/api
Discovers hidden parameters the endpoint responds to.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
arjun
Usage examples
arjun -u https://target.tld/api
Discover hidden parameters.
arjun -u https://t -m POST
Find hidden POST parameters.
Advantages
- Finds undocumented params
- Fast, low false positives
Disadvantages
- Active requests
- Wordlist-bound
Tags
#web#parameters
Official docs: Arjun ↗
Related commands
Frequently asked questions
What is Arjun used for?
Arjun finds hidden GET/POST parameters an endpoint accepts — uncovering attack surface for injection.
What is an example Arjun command?
A common example is: arjun -u https://example.com/api — Discovers hidden parameters the endpoint responds to.
Is Arjun part of Kali Linux?
Yes. Arjun ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install arjun.
What category of security tool is Arjun?
Arjun is a Web Application tool with a medium-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.