kiterunner

kr command [options] target

kiterunner is a context-aware content discovery tool designed specifically for finding API endpoints on web applications. Unlike traditional directory brute-forcing tools that simply append paths to a base URL, kiterunner understands API routing conventions and sends requests that mimic legitimate API calls, including appropriate HTTP methods, headers, and content types for each candidate route.The tool ships with curated wordlists from Assetnote that are tailored for common API frameworks such as Rails, Django, Express, and Spring. It supports both a `scan` mode for intelligent API-aware discovery and a `brute` mode for traditional directory enumeration, giving security professionals flexibility during reconnaissance and penetration testing engagements.

scan URL

Context-aware API endpoint discovery using datasets with correct HTTP methods, headers, and parameters.

Vanilla directory brute-forcing with custom wordlists.

Replay a previously discovered request, optionally through a proxy.

Wordlist file.

Use wordlist from wordlist.assetnote.io. Optionally append `;N` to limit to first N lines.

Add HTTP header.

Output file.

Maximum concurrent connections per host (recommend 5-10).

Skip host alive discovery before scanning.

Display help information.

Security testing tool. Authorized use only. Go-based.

kiterunner was created by Assetnote for API endpoint discovery during security assessments.

ffuf(1), gobuster(1), dirsearch(1)