---
name: "arjun"
section: "1"
platform: "linux"
package: "arjun"
version: "2.2.7-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/arjun"
---

# arjun(1)

HTTP parameter discovery suite

## NAME

**arjun** - HTTP parameter discovery suite

## SYNOPSIS

```
arjun [-h] [-u URL] [-o JSON_FILE] [-oT TEXT_FILE] [-oB [BURP_PORT]] [-d DELAY] [-t THREADS] [-w WORDLIST] [-m METHOD] [-i [IMPORT_FILE]]
      [-T TIMEOUT] [-c CHUNKS] [-q] [--headers [HEADERS]] [--passive [PASSIVE]] [--stable] [--include INCLUDE] [--disable-redirects]
```

## DESCRIPTION

**Arjun can find query parameters for** *URL* **endpoints. If you don't get what that means, it's okay, read along.** **Web applications use parameters (or queries) to accept user input, take the following example into consideration:**

```
    http://api.example.com/v1/userinfo?id=751634589
```

**This** *URL* **seems to load user information for a specific user id, but what if there exists a parameter named admin which** **when set to True makes the endpoint provide more information about the user?** **This is what Arjun does, it finds valid HTTP parameters with a huge default dictionary of 25,890 parameter names.** **The best part? It takes less than 10 seconds to go through this huge list while making just 50-60 requests to the target. Here's how.**

- **-**

  **Supports GET/POST/POST-JSON/POST-XML requests**

- **-**

  **Automatically handles rate limits and timeouts**

- **-**

  **Export results to: BurpSuite, text or JSON file**

- **-**

  **Import targets from: BurpSuite, text file or a raw request file**

- **-**

  **Can passively extract parameters from JS or 3 external sources**

## OPTIONS

- **-h, --help**

  **show this help message and exit.**

- **-u *URL***

  **Target** *URL***.**

- **-o *JSON\_FILE*, -oJ *JSON\_FILE***

  **Path for json output file.**

- **-oT *TEXT\_FILE***

  **Path for text output file.**

- **-oB \[*BURP\_PORT*\]**

  **Port for output to Burp Suite Proxy. Default port is 8080.**

- **-d *DELAY***

  **Delay between requests in seconds. (default: 0).**

- **-t *THREADS***

  **Number of concurrent threads. (default: 5).**

- **-w *WORDLIST***

  **Wordlist file path. (default: /usr/lib/python3/dist-packages/arjun/db/large.txt).**

- **-m *METHOD***

  **Request method to use: GET/POST/XML/JSON/***HEADERS***. (default: GET).**

- **-i \[*IMPORT\_FILE*\]**

  **Import target URLs from file.**

- **-T *TIMEOUT***

  **HTTP request timeout in seconds. (default: 15).**

- **-c *CHUNKS***

  **Chunk size. The number of parameters to be sent at once.**

- **-q**

  **Quiet mode. No output.**

- **--headers \[*HEADERS*\]**

  **Add headers. Separate multiple headers with a new line.**

- **--passive \[*PASSIVE*\]**

  **Collect parameter names from passive sources like wayback, commoncrawl and otx.**

- **--stable**

  **Prefer stability over speed.**

- **--include *INCLUDE***

  **Include this data in every request.**

- **--disable-redirects**

  **disable redirects.**

## EXAMPLES

**arjun -h**

**arjun -u http://site.example.com/test.php**

**arjun -u http://site.example.com/test.php -o test.json**

**arjun -u http://site.example.com -t 5**

**arjun -u http://site.example.com --stable**

## AUTHOR

**Written by Somdev Sangwan \<s0md3v@gmail.com\>**

**This manual page was written by Guilherme de Paula Xavier Segundo** **\<guilherme.lnx@gmail.com\> for the Debian project (but may be used by others).**