Kiterunner

Context-aware API route brute-forcer using real-world API schema wordlists (Assetnote).

Quick Start

# Download binary from https://github.com/assetnote/kiterunner/releases

# Scan with default wordlist
kr scan https://target.com -w routes-small.kite

# Scan from file of hosts
kr scan hosts.txt -w routes-large.kite -x 20

# Replay a finding with full request detail
kr replay -w routes-small.kite "GET   403 [   191,    9,   1] https://target.com/api/v1/user"