kiterunner-brute
performs traditional wordlist-based bruteforce against API endpoints
TLDR
Bruteforce API endpoints
$ kr brute [https://api.example.com] -w [wordlist.txt]
Bruteforce with specific methods$ kr brute [url] -w [wordlist.txt] -X GET,POST
Bruteforce with headers$ kr brute [url] -w [wordlist.txt] -H "Authorization: Bearer [token]"
SYNOPSIS
kr brute [options] target
DESCRIPTION
kr brute performs traditional wordlist-based bruteforce against API endpoints. Part of Kiterunner, an API endpoint discovery tool by Assetnote. Tests various HTTP methods and paths to discover hidden endpoints.
PARAMETERS
-w wordlist
Wordlist file for bruteforcing.-X methods
HTTP methods to use.-H header
Add custom header.-t threads
Number of concurrent threads.-o file
Output file.
SEE ALSO
kiterunner-wordlist(1), gobuster(1)