arjun

Name: arjun
Availability: InStock
Author: Dave

Discover hidden HTTP parameters in REST and GraphQL endpoints.

15|1|Updated Feb 12, 2026

Search Tags:#api #reconnaissance #web security #fuzzing #http parameters

Ready to run

npx skills add https://github.com/AeonDave/malskill --skill arjun

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: arjun
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/api/arjun
Command: npx skills add https://github.com/AeonDave/malskill --skill arjun

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires arjun, and includes references (resource) components.

What problem does it solve?

This Skill helps uncover hidden or undocumented HTTP parameters in web APIs, which is crucial for thorough security testing and understanding API functionality.

Core Features & Use Cases

Parameter Discovery: Finds GET, POST, JSON, and XML parameters in web endpoints.
API Reconnaissance: Essential for security assessments and identifying potential attack vectors.
Use Case: When testing a web application's API, use this Skill to find any parameters that are not part of the official documentation, potentially revealing sensitive or exploitable inputs.

Quick Start

Use the arjun skill to discover hidden GET parameters for the URL https://target.com/api/endpoint.

Frequently Asked Questions about arjun

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I discover hidden HTTP parameters in a web API endpoint?▼

Hidden HTTP parameter discovery targets query, body, and header parameters in REST and GraphQL endpoints to find undocumented inputs. This technique is essential for web security assessments and API reconnaissance to identify potential attack vectors.

How do I find undocumented GET and POST parameters for fuzzing?▼

You can find undocumented GET and POST parameters by running a parameter discovery scan against your target URL. This identifies hidden JSON and XML inputs, enabling comprehensive fuzzing of web endpoints for potential security vulnerabilities.

Do I need Python installed to find hidden HTTP parameters?▼

Yes, you need Python installed along with the specific 'arjun' Python package to execute hidden parameter discovery. This dependency is required to run the scans that identify undocumented query, body, and header parameters in web endpoints.

Can I discover hidden parameters in GraphQL APIs?▼

Yes, hidden parameter discovery supports GraphQL endpoints in addition to REST APIs. It targets query, body, and header parameters to uncover undocumented inputs, enabling thorough security testing and reconnaissance across different API architectures.

What's the best way to scan web endpoints for hidden JSON and XML parameters?▼

The best way to scan for hidden JSON and XML parameters is using a dedicated parameter discovery tool that supports various request methods and input formats. This approach systematically uncovers undocumented inputs in web endpoints for security assessments.