arjun

No entries match these filters. Clear filters

1. 2.2.7 Nov 3, 2024 · release notes

   Arjun 2.2.7 adds casing style enforcement and explicit rate-limit control for parameter discovery.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.2.7 https://github.com/s0md3v/Arjun.git
   # already have the repo? check out this version:
   $ git checkout 2.2.7

   └──▷ TRY IT
   Enforce camelCase output when probing an API that uses camelCase parameter names, reducing false negatives from style mismatches.
   copy

   $ arjun -u https://api.example.com/endpoint --casing camel

   Throttle discovery to stay under a WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. or target server's request threshold during a sensitive engagement.
   copy

   $ arjun -u https://target.example.com/search --ratelimit 5

   • New --casing option enforces a specific casing style on discovered parameters.
   • New --ratelimit option sets an explicit requests-per-second cap during scanning.

   2 details in Everything

2. 2.2.0 Sep 11, 2022 · release notes

   Adds response-based value correlation and required parameter detection for deeper parameter analysis

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.2.0 https://github.com/s0md3v/Arjun.git
   # already have the repo? check out this version:
   $ git checkout 2.2.0

   • Adds --detect-value to enable detection of parameters that respond specifically to a given payload (e.g., identifying boolean-based blind injection points by probing with specific values).
   • Adds --req-param flag to trigger required parameter detection, allowing the tool to identify parameters that must be present for valid responses.
   • Updates heuristic engine to extract semantic content from JSON and text responses, improving context awareness for value-correlated detections.

   3 details in Everything

3. 2.1.5 Apr 9, 2022 · release notes

   Adds --disable-redirects flag to bypass HTTP redirects during parameter discovery

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.1.5 https://github.com/s0md3v/Arjun.git
   # already have the repo? check out this version:
   $ git checkout 2.1.5

   └──▷ USE IT
   Discover parameters on a target that redirects requests, preventing Arjun from following the redirect chain.
   shell copy

   arjun -u "https://example.com/page" --disable-redirects

   • --disable-redirects option
   • New logic for handling redirections

   2 details in Everything

4. 2.0-beta Prerelease Dec 6, 2020 · release notes

   Arjun 2.0-beta adds --passive source integration, parameter concurrency control -c, and HTTP timeout option -T

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.0-beta https://github.com/s0md3v/Arjun.git
   # already have the repo? check out this version:
   $ git checkout 2.0-beta

   └──▷ TRY IT
   Scan for hidden parameters by querying passive intelligence sources before active testing.
   copy

   $ arjun -u https://example.com --passive

   Control concurrency to avoid overwhelming the target server during large-scale scanning.
   copy

   $ arjun -u https://example.com -c 10

   Set a specific timeout for HTTP requests to handle slow or unresponsive endpoints.
   copy

   $ arjun -u https://example.com -T 30

   • --passive option for collecting parameters from otx, commoncrawl and archive.org
   • -c option to define number of parameters to be sent at once
   • -T option to specify HTTP connection timeout

   3 details in Everything