Finding Hidden Parameters with Arjun

When I first started learning bug bounty hunting, I spent a lot of time testing the parameters that were already visible in a URL. If a page contained something like:

https://example.com/search?q=test

https://example.com/search?q=test

I knew I could test the q parameter.

But after reading bug bounty write-ups, I realized that many interesting parameters aren't visible at all. Developers often leave hidden GET parameters that aren't linked anywhere on the website, and manually guessing them is almost impossible.

That's when I discovered Arjun.

After using it in my reconnaissance workflow, I found that it can automatically discover hidden HTTP GET parameters making the testing process much more efficient.

In this article, I'll explain what Arjun is, how I installed it and how I use it during bug bounty reconnaissance.

What is Arjun?

Arjun is an open-source HTTP parameter discovery tool created to identify hidden GET parameters.

Instead of manually guessing parameter names, Arjun sends intelligent requests using a built-in wordlist and analyzes the application's responses to determine whether additional parameters exist.

This helps uncover hidden functionality that may not be obvious during normal browsing.

Why I Started Using Arjun

Before using Arjun, my workflow looked something like this:

• Crawl the application.
• Find URLs.
• Test visible parameters manually.
• Guess common parameter names.

Most of the time, I wasn't finding anything useful.

After trying Arjun, I realized it could automate parameter discovery and save a lot of time.

Instead of guessing hundreds of parameter names myself, the tool handled the process automatically.

Installing Arjun

Installing Arjun on Kali Linux is straightforward.

Create a virtual environment first:

python3 -m venv venv
source venv/bin/activate

python3 -m venv venv
source venv/bin/activate

Then install Arjun.

pip install arjun

pip install arjun

Verify the installation.

arjun -h

arjun -h

Running My First Scan

For my first test, I scanned a single endpoint.

arjun -u https://example.com/search

arjun -u https://example.com/search

Arjun started testing multiple parameter names and analyzed the application's responses.

Within a short time, it reported the parameters that appeared to be accepted by the server.

This was much faster than manually testing dozens of possible names.

Scanning POST Requests

Arjun also supports POST requests.

arjun -u https://example.com/login -m POST

arjun -u https://example.com/login -m POST

This is useful when testing forms that submit data using POST instead of GET.

Using a Custom Wordlist

Although Arjun includes an excellent built-in parameter list, you can also provide your own.

arjun -u https://example.com/search -w params.txt

arjun -u https://example.com/search -w params.txt

This allows you to test custom parameter names that are specific to a target or application.

Saving the Results

I usually save my results for later analysis.

arjun -u https://example.com/search -oT parameters.txt

arjun -u https://example.com/search -oT parameters.txt

Now every discovered parameter is stored in one file.

This makes it easier to continue testing without running the scan again.

Why Hidden Parameters Matter

Many applications contain parameters that aren't visible in normal navigation.

Examples include:

• Debug parameters
• Search filters
• Admin functions
• Export options
• API features
• Hidden functionality

Discovering these parameters doesn't automatically mean there's a vulnerability.

However, they often expose additional features that deserve further testing.

My Bug Bounty Workflow

This is how I usually use Arjun.

1. Collect subdomains.
2. Identify live hosts using httpx.
3. Discover URLs using Katana or waymore.
4. Choose interesting endpoints.
5. Run Arjun against those endpoints.
6. Test any discovered parameters manually.

Using Arjun after URL discovery has worked much better for me than blindly scanning random pages.

Tips for Beginners

If you're just getting started with Arjun, here are a few suggestions.

• Test one endpoint at a time.
• Save your results.
• Focus on interesting pages like search, login, profile, API, and download endpoints.
• Don't assume every discovered parameter is vulnerable.
• Always verify your findings manually.

Good reconnaissance is about collecting useful information before attempting exploitation.

My Experience

After adding Arjun to my toolkit, I stopped wasting time manually guessing parameter names.

It helped automate one of the most repetitive parts of reconnaissance and occasionally revealed parameters that weren't visible anywhere on the website.

I now use it regularly whenever I encounter endpoints that look like they may accept additional input.

Final Thoughts

Arjun is one of those tools that quietly saves a lot of time.

Instead of manually testing hundreds of possible parameter names, it automates the process and lets you focus on analyzing the results.

If you're learning bug bounty or web application security, it's definitely worth adding to your reconnaissance toolkit.

Remember, discovering hidden parameters is only the beginning. The real work starts when you analyze how the application handles them.

GitHub Repository

GitHub - s0md3v/Arjun: HTTP parameter discovery suite. HTTP parameter discovery suite. Contribute to s0md3v/Arjun development by creating an account on GitHub.

Need Help?

If you run into any issues while installing or using Arjun, don't worry. Every beginner encounters installation errors or configuration problems while learning new tools.

If you get stuck, feel free to contact me.

Connect with me

X (Twitter): https://x.com/Commanak46

I'll do my best to help.

Happy hunting ✨