In the fourth week of the blog series, in which we present various hacking tools, we will deal with Arjun, but we are still in the reconnaissance phase, which means that we want to get to know our target system as well as possible. Unlike the previous tools, our pentest tool #4 Arjun is not pre-installed in Kali Linux.
Installation of Arjun
As mentioned in the introduction, the tool Arjun is not pre-installed in Kali Linux. Therefore we have to download the pentest tool #4 first. A public GitHub repository contains Arjun and gives us the possibility to download the program without any problems.
A detailed documentation of GitHub itself describes how users can download a repository. Git is a version control software that is often used by development teams. This software has a command line version, which is preinstalled in e.g. Kali Linux.
To download a repository you only have to enter “git clone https://github.com/s0md3v/Arjun” into your terminal. After “git clone” you will find the destination address of the repository you want to download. After you have executed this command and the download is complete, you will find a folder named Arjun in your current directory.
In this folder you will find the whole repository with e.g. the README.md file but also the main program arjun.py.
Pentest-Tool #4 – Arjun
The first two Tools we covered in the blog series were there to find hidden paths. The Pentest tool #4 can be used well afterwards, after finding already hidden paths and various subpages.
Because the task or function of Arjun is to detect hidden functions in the form of HTML parameters. Web applications use HTML parameters to store and manage user input. A similar brute force approach is used in the first pentest tools to find different functions or parameter types that are accepted by the web server.
In contrast to the already known tools, Arjun does not need to attach a word list, because they are already included in the repository.
Pentest tool #4 in practice
In our example we do not run Arjun in Kali Linux but on an iOS device. Since the installation and execution is identical to that for Kali Linux, there is no difference whether our Pentest Tool #4 runs on a Linux or iOS device.
After downloading the repository we have to move to the folder where the main program is located. In the command line we can do this with the command: “cd Arjun” (cd = change directory). Now we can start the tool directly from the command line by typing “python3 arjun.py -u https://www.it-sicherheit.de/anbieterverzeichnis” and execute it.
The program consists of a Python file, which we execute with Python3. After the parameter -u we enter the destination address we want to check for different HTML parameters, in our example www.it-sicherheit.de/anbieterverzeichnis.
The results show that 6 different parameters could be found. These parameters could now be analyzed in the next step of a pentest to look for vulnerabilities which could be caused by the different parameters.
