Automic VaultAutomic Vault

brew

Install arjun with Homebrew, apt, Nix

HTTP parameter discovery suite. Version 2.2.7 via Homebrew; verified 2026-06-22.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install arjun

local Homebrew formula metadata

Linux

Debian aptverified · 92%
sudo apt install arjun

Debian stable package indexes · arjun · source: deb.debian.org

Nixverified · 92%
nix profile install nixpkgs#arjun

nixpkgs package indexes · pkgs/by-name/ar/arjun/package.nix · source: api.github.com

overview

Package summary

HTTP parameter discovery suite

Commands and aliases

  • arjun

history

Project history and usage

Arjun is an HTTP parameter discovery suite for reconnaissance and application-security testing. Its README describes the core job plainly: find valid query or body parameters for URL endpoints, using a large built-in parameter-name dictionary while trying to keep request counts low.

Project history

Arjun is maintained in the s0md3v/Arjun GitHub repository and distributed as a Python CLI. The official README positions it around practical web testing tasks: GET, POST, JSON, and XML request probing; timeout and rate-limit handling; output to Burp Suite, text, or JSON; and target import from files, Burp, or raw HTTP requests.

The project release stream visible from the official GitHub releases shows 1.x releases by 2018-2019, a 2.0 beta in 2020, and continued 2.2.x releases through 2024. The README's installation recommendation is pipx, with pip as a fallback for older Python environments.

Adoption history

The supplied package facts show Arjun packaged for Homebrew, Debian, Ubuntu, and Nix, which is typical for Python security tooling that becomes useful enough to install from OS and developer package managers rather than only from source.

Arjun's adoption niche is bug bounty, recon, and API testing workflows where hidden or undocumented parameters can change endpoint behavior. Its README credits Common Crawl, SecLists, Param Miner, and data-payloads as sources or relatives for the parameter wordlists, tying it to the broader web-security wordlist ecosystem.

How it is used

The executable is arjun. Users normally point it at one URL or a list of targets, choose request methods and headers as needed, and export discovered parameters for later manual testing or Burp-centered workflows.

The official README does not document a persistent config file or credential store. Operationally, options are passed on the command line or through imported request/target files.

Why package nerds care

Arjun is package-nerdy because it turns a common recon step into a repeatable CLI primitive. It is small, Python-packaged, and easy to drop into Homebrew, distro packages, Nix shells, or security-tool images.

Its value is not a framework or scanner platform; it is the narrow, automatable act of parameter discovery. That narrowness is why it fits well beside tools like Burp, SecLists, Param Miner, ffuf, httpx, and other recon CLIs.

Timeline

  • 2018: Official GitHub releases show Arjun 1.1.
  • 2019: Official releases show 1.2-beta through 1.6.
  • 2020: Official releases show 2.0-beta.
  • 2024: Official releases show 2.2.x releases through 2.2.7.

Related projects

  • Related projects and data sources named by the README include SecLists, PortSwigger Param Miner, Common Crawl-derived wordlists, Burp Suite, and data-payloads.
  • In workflows it commonly sits near HTTP probing, fuzzing, and recon tools rather than full vulnerability scanners.

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for arjun. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 1 platform targets.
  • Installs with 2 runtime dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
arjuncliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-10
manager version2.2.7
manager updated2026-06-22
local dataok
upstreamnot checked
latest detectednot detected

https://github.com/s0md3v/Arjun

install metadata

Package metadata

Package keybrew:arjun
Version2.2.7
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/arjun
Homepagehttps://github.com/s0md3v/Arjun
Repositoryhttps://github.com/s0md3v/Arjun
Upstream docshttps://github.com/s0md3v/Arjun#readme
LicenseAGPL-3.0-only
Source archivehttps://files.pythonhosted.org/packages/04/22/c5b969720d2802de2248c2aac0414ee5ae234887cfe150564d591c73fb23/arjun-2.2.7.tar.gz
Last updated2026-06-22T10:12:13-04:00
Pulseupdated
Dependenciescertifi, python@3.14
Bottleavailable (on all)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namearjun
Version Scheme0
Revision7
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Debian apt95%

arjun 2.2.7-1

HTTP parameter discovery suite

https://github.com/s0md3v/Arjun

sudo apt install arjun
  • Section: misc
  • Architecture: all
  • 4 dependencies
  • normalized package name match
  • Matched by: Arjun
Debian stable package indexes · deb.debian.org · Debian stable package indexes: arjun from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Nix95%

arjun

nix profile install nixpkgs#arjun
  • normalized package name match
  • Matched by: Arjun
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/ar/arjun/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
Ubuntu apt95%

arjun 2.2.1-2

HTTP parameter discovery suite

https://github.com/s0md3v/Arjun

sudo apt install arjun
  • Section: universe/misc
  • Architecture: all
  • 3 dependencies
  • normalized package name match
  • Matched by: Arjun
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: arjun from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

Same workflow

  • forbiddenShares av.db curated category or tags: cli, http, security.
  • httpxShares av.db curated category or tags: cli, http, security.
  • slowhttptestShares av.db curated category or tags: cli, http, security.
  • acme.shShares av.db curated category or tags: cli, security.
  • aescryptShares av.db curated category or tags: cli, security.
  • aespipeShares av.db curated category or tags: cli, security.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment