Arjun

Enumerating request parameters.

Usage

Single URL

arjun -u http://localhost/api/users -m POST -o users_results.txt

Multiple Targets

# Text files, raw request files, Burp Suite targets
arjun -i targets.txt

Export

# JSON
arjun -u https://api.example.com/endpoint -oJ result.json
# Text
arjun -u https://api.example.com/endpoint -oT result.txt
# Burp Suite
arjun -u https://api.example.com/endpoint -oB 127.0.0.1:8080

Injection Point

# JSON
arjun -u https://api.example.com/endpoint -m JSON --include='{"root":{"a":"b",$arjun$}}'
# XML
arjun -u https://api.example.com/endpoint -m XML --include='<?xml><root>$arjun$</root>'

Data

# Parameters
arjun  -u https://api.example.com/endpoint --include 'api_key=xxxxx&param2=test'
# JSON data
arjun  -u https://api.example.com/endpoint --include '{"api_key":"xxxxx"}'

Headers

arjun -u https://api.example.com/endpoint --headers "Accept-Language: en-US\nCookie: null"

Resources

Repository

GitHub - s0md3v/Arjun: HTTP parameter discovery suite.GitHub

Wiki

HomeGitHub

Video Tutorial