NAME
  arjun - HTTP parameter discovery suite

SYNOPSIS
  arjun [-h] [-u URL] [-o JSON_FILE] [-oT TEXT_FILE] [-oB [BURP_PORT]] [-d DELAY] [-t THREADS] [-w WORDLIST] [-m METHOD] [-i [IMPORT_FILE]]
        [-T TIMEOUT] [-c CHUNKS] [-q] [--headers [HEADERS]] [--passive [PASSIVE]] [--stable] [--include INCLUDE] [--disable-redirects]

DESCRIPTION
  Arjun can find query parameters for URL endpoints. If you don't get what that means, it's okay, read along.
  Web applications use parameters (or queries) to accept user input, take the following example into consideration:

    http://api.example.com/v1/userinfo?id=751634589

  This URL seems to load user information for a specific user id, but what if there exists a parameter named admin which
  when set to True makes the endpoint provide more information about the user?
  This is what Arjun does, it finds valid HTTP parameters with a huge default dictionary of 25,890 parameter names.
  The best part? It takes less than 10 seconds to go through this huge list while making just 50-60 requests to the target. Here's how.

  -  Supports GET/POST/POST-JSON/POST-XML requests
  -  Automatically handles rate limits and timeouts
  -  Export results to: BurpSuite, text or JSON file
  -  Import targets from: BurpSuite, text file or a raw request file
  -  Can passively extract parameters from JS or 3 external sources

OPTIONS
  -h, --help                                  show this help message and exit.
  -u URL                                      Target URL.
  -o JSON_FILE, -oJ JSON_FILE                 Path for json output file.
  -oT TEXT_FILE                               Path for text output file.
  -oB [BURP_PORT]                             Port for output to Burp Suite Proxy. Default port is 8080.
  -d DELAY                                    Delay between requests in seconds. (default: 0).
  -t THREADS                                  Number of concurrent threads. (default: 5).
  -w WORDLIST                                 Wordlist file path. (default: /usr/lib/python3/dist-packages/arjun/db/large.txt).
  -m METHOD                                   Request method to use: GET/POST/XML/JSON/HEADERS. (default: GET).
  -i [IMPORT_FILE]                            Import target URLs from file.
  -T TIMEOUT                                  HTTP request timeout in seconds. (default: 15).
  -c CHUNKS                                   Chunk size. The number of parameters to be sent at once.
  -q                                          Quiet mode. No output.
  --headers [HEADERS]                         Add headers. Separate multiple headers with a new line.
  --passive [PASSIVE]                         Collect parameter names from passive sources like wayback, commoncrawl and otx.
  --stable                                    Prefer stability over speed.
  --include INCLUDE                           Include this data in every request.
  --disable-redirects                         disable redirects.

EXAMPLES
  arjun -h

  arjun -u http://site.example.com/test.php

  arjun -u http://site.example.com/test.php -o test.json

  arjun -u http://site.example.com -t 5

  arjun -u http://site.example.com --stable


AUTHOR
  Written by Somdev Sangwan <s0md3v@gmail.com>

  This manual page was written by Guilherme de Paula Xavier Segundo
  <guilherme.lnx@gmail.com> for the Debian project (but may be used by others).
