skills.rest
AeonDave
AeonDaveCOMMUNITY
Explore all skills by this author →
GitHub

arjun

Discover hidden HTTP parameters in REST and GraphQL endpoints.

15|1|Updated Feb 12, 2026
Search Tags:#api#reconnaissance#web security#fuzzing#http parameters
One-click install
npx skills add https://github.com/AeonDave/malskill --skill arjun
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: arjun
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/api/arjun
Command: npx skills add https://github.com/AeonDave/malskill --skill arjun

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires arjun, and includes references (resource) components.

What problem does it solve?

This Skill helps uncover hidden or undocumented HTTP parameters in web APIs, which is crucial for thorough security testing and understanding API functionality.

Core Features & Use Cases

  • Parameter Discovery: Finds GET, POST, JSON, and XML parameters in web endpoints.
  • API Reconnaissance: Essential for security assessments and identifying potential attack vectors.
  • Use Case: When testing a web application's API, use this Skill to find any parameters that are not part of the official documentation, potentially revealing sensitive or exploitable inputs.

Quick Start

Use the arjun skill to discover hidden GET parameters for the URL https://target.com/api/endpoint.

Frequently Asked Questions about arjun

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover hidden HTTP parameters in a web API endpoint?▼

Hidden HTTP parameter discovery targets query, body, and header parameters in REST and GraphQL endpoints to find undocumented inputs. This technique is essential for web security assessments and API reconnaissance to identify potential attack vectors.

How do I find undocumented GET and POST parameters for fuzzing?▼

You can find undocumented GET and POST parameters by running a parameter discovery scan against your target URL. This identifies hidden JSON and XML inputs, enabling comprehensive fuzzing of web endpoints for potential security vulnerabilities.

Do I need Python installed to find hidden HTTP parameters?▼

Yes, you need Python installed along with the specific 'arjun' Python package to execute hidden parameter discovery. This dependency is required to run the scans that identify undocumented query, body, and header parameters in web endpoints.

Can I discover hidden parameters in GraphQL APIs?▼

Yes, hidden parameter discovery supports GraphQL endpoints in addition to REST APIs. It targets query, body, and header parameters to uncover undocumented inputs, enabling thorough security testing and reconnaissance across different API architectures.

What's the best way to scan web endpoints for hidden JSON and XML parameters?▼

The best way to scan for hidden JSON and XML parameters is using a dedicated parameter discovery tool that supports various request methods and input formats. This approach systematically uncovers undocumented inputs in web endpoints for security assessments.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
5

param-miner

Discover hidden HTTP parameters in web applications using Arjun and x8 workflows.

Community
Intermediate
jinyimeng01jinyimeng01
54

api-fuzz

Select semantic fuzzing payloads for API parameters based on attack patterns.

Community
Intermediate
pdparchitectpdparchitect
13

hunt-http-smuggling

Detect and validate HTTP request smuggling vectors between proxies and servers.

Community
Advanced
jthackjthack
205

ffuf-web-fuzzing

Fuzz web targets to discover hidden directories, files, subdomains, and API endpoints.

Community
Advanced