> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/methodology/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/methodology/readme/exploitation/web-applications/discovering-hidden-parameters.md).

# Discovering Hidden Parameters

{% embed url="<https://github.com/s0md3v/Arjun>" %}

Arjun is a tool designed to discover hidden parameters in websites.&#x20;

![](https://3418038199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyTPWZkKJbJfX8uHiRzmn%2Fuploads%2FuTxkTrD4Ard6A6D5HtGK%2F0ECFB3D2-BB48-443C-964A-1F8035BB0B5D_4_5005_c.jpeg?alt=media\&token=f7933ef1-fd14-41ff-8ac7-b3dcdbee9ace)

Notice how the tool was able to find the parameter flag.

Lets take another example for the sake of explanation.

![](https://3418038199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyTPWZkKJbJfX8uHiRzmn%2Fuploads%2Fd1CWgIllsEufywm0BGIw%2F2022-08-13_10-30.png?alt=media\&token=91fe88ce-b800-41d5-a696-15d592845a42)

Notice the page parameter.&#x20;

![](https://3418038199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyTPWZkKJbJfX8uHiRzmn%2Fuploads%2FeOH7ltXEVbu7LVJYvQ8g%2F2022-08-13_10-31.png?alt=media\&token=80a7a14f-c169-478e-893e-52bc1b456fe1)

Notice how arjun was able to figure out the parameter page on its own.&#x20;