Tool Spotlight: Kiterunner for Context-Aware API Discovery
You are five hours into a black-box penetration test against a modern Single Page Application (SPA). You've pointed Gobuster and Feroxbuster at the target. They've found a few generic folders—/css, /js, /assets—but the actual API driving the application is completely invisible.
Why? Because traditional directory brute-forcing tools blindly hammer the server with HTTP GET requests looking for 200 OK responses. They don't understand that modern APIs often require a specific HTTP method (like POST or PUT), specific headers, or a specific path depth to return anything other than a 404 Not Found or 405 Method Not Allowed.
If you are only using traditional file discovery tools, you are leaving the most critical attack surface entirely unmapped. Enter Kiterunner.
What Problem Kiterunner Solves
Developed by the team at Assetnote, Kiterunner was built explicitly to solve the API discovery problem. It isn't just a brute-forcer; it is a context-aware API enumeration tool.
Instead of guessing random words, Kiterunner utilizes massive datasets compiled from Swagger files and OpenAPI specifications across the internet. When it tests an endpoint, it doesn't just ask if /api/v1/user exists. It asks if /api/v1/user exists when accessed via a POST request, and it structures the request to mimic a legitimate API call.
A comparison of how a traditional brute-forcer completely misses API routes because of method mismatches, while Kiterunner successfully maps the attack surface using context-aware methods.
Where it Fits in the Workflow
Kiterunner belongs squarely in your active reconnaissance phase. Once you have enumerated subdomains and identified a host running a web application, Kiterunner should be the first tool you run against the root URL (or suspected API endpoints like api.target.com).
It paves the way for tools like Burp Suite or Caido. You use Kiterunner to map the invisible doors, and then you use an intercepting proxy to pick the locks on those specific doors.
Installation and Setup
Kiterunner is written in Go, making installation trivial. You can grab the latest binary from the GitHub releases page, or compile it from source.
# Clone and build Kiterunner from source (assuming Go is installed) git clone https://github.com/assetnote/kiterunner.git cd kiterunner make build sudo ln -s $(pwd)/dist/kr /usr/local/bin/kr # Download the essential API wordlists provided by Assetnote mkdir ~/kr-wordlists && cd ~/kr-wordlists wget https://wordlists-cdn.assetnote.io/data/kiterunner/routes-large.kite
Realistic Usage Examples
Kiterunner is incredibly fast, but its real power lies in how it handles the responses. It automatically groups similar response lengths and status codes, drastically reducing the noise.
1. The Initial API Sweep
Here is how you execute a scan against an authorized lab target, using the large routes dataset. Notice that we don't have to specify HTTP methods; the .kite wordlist already contains the method context.
# Scan a target using a compiled .kite dataset with 20 parallel connections kr scan https://api.example-lab-target.com -w ~/kr-wordlists/routes-large.kite -x 20
The output will look something like this:
GET 403 [ 214, 5, 1] https://api.example-lab-target.com/api/v1/users
POST 200 [ 512, 12, 3] https://api.example-lab-target.com/api/v1/users/create
PUT 401 [ 88, 2, 1] https://api.example-lab-target.com/api/v1/users/update
Notice how it instantly identified that /api/v1/users/create requires a POST request. Gobuster would have missed this entirely.
2. Replaying Discovered Requests
Once Kiterunner finds an interesting endpoint, you don't have to manually recreate the request in Burp. You can use Kiterunner's built-in kb (kitebuilder) replay function to see exactly what was sent and received.
# Replay the specific POST request found in the previous scan to analyze the headers kr kb replay -w ~/kr-wordlists/routes-large.kite -u https://api.example-lab-target.com/api/v1/users/create
Strengths & Limitations
Strengths:
- Context-Aware: It fundamentally understands RESTful routing and Swagger specifications.
- Speed: Built in Go, it handles massive concurrency effortlessly without dropping connections.
- Noise Reduction: Intelligent grouping of responses means you don't have to sift through thousands of identical
403 Forbiddenpages.
Limitations:
- Not a Vulnerability Scanner: Kiterunner will find the door, but it won't tell you if the lock is broken. It is purely for discovery.
- Dataset Dependency: Its effectiveness relies heavily on the quality of the
.kitedatasets. While Assetnote maintains excellent lists, highly bespoke, non-standard APIs might still require custom fuzzing.
Maintenance and Maturity Reality Check
Kiterunner (v1.0.2 as of recent updates) is a mature, stable project actively maintained by Assetnote. With over 3,000 stars on GitHub, it has firmly established itself as an industry standard. While it doesn't see daily commits, it doesn't need to—the core engine is highly optimized, and the value comes from the continuously updated wordlists provided by the Assetnote team.
Alternatives
- FFUF (Fuzz Faster U Fool): FFUF is the undisputed king of web fuzzing. However, to replicate Kiterunner's functionality in FFUF, you would need to run multiple parallel jobs iterating through various HTTP methods and custom header combinations. Use FFUF for deep fuzzing after Kiterunner maps the surface.
- Feroxbuster: Incredible for traditional recursive directory discovery, but lacks the API-specific method awareness out of the box.
The Verdict
If your scope includes web applications, Kiterunner is mandatory. Relying solely on standard directory bruteforcing in 2026 means you are practically ignoring the underlying API infrastructure. Map the API with Kiterunner, proxy the traffic through Burp Suite or Caido, and then use your deep-dive fuzzers to hunt for authorization bypasses.
If you want to learn more about attacking the APIs you discover, check out our guide on Hunting for BOLA and our Modern Web Recon Workflow.
References / Further reading
- Kiterunner Official GitHub Repository - Assetnote - https://github.com/assetnote/kiterunner
- Assetnote Wordlists - Assetnote - https://wordlists.assetnote.io/
- Contextual API Discovery with Kiterunner - InfoSec Writeups - https://infosecwriteups.com/contextual-api-discovery-with-kiterunner
- API Reconnaissance Methodologies - HackDB - https://hackdb.com/api-reconnaissance
