When you think of the Kite Runner by Khaled Hosseini, you think of the beautiful tale of friendship in a world filled with hatred and pain…

API Endpoints Discovery using Kiterunner Source : Github Kiterunner APIs are the backbone of modern applications, and discovering hidden API endpoints can reveal valuable attack surfaces for bug bounty hunters. Kiterunner, an advanced content discovery tool, helps automate this process by fuzzing API endpoints efficiently. This guide will walk you through using Kiterunner for API endpoint discovery. What is Kiterunner? Kiterunner is a tool designed for brute-forcing API endpoints using wordlists generated from OpenAPI specifications. Unlike traditional fuzzers that rely on wordlists meant for web paths, Kiterunner focuses on structured API routes, making it a powerful tool for API recon. Why Use Kiterunner? Discovers hidden API endpoints that may not be documented Works with structured API wordlists Works on both REST and GraphQL APIs Installation : 1. Install Golang (if not installed) Kiterunner is built with Go, so you need it installed first: sudo apt install golang Or install manually from Go’s official website. 2. Install Kiterunner Clone and Install kiterunner git clone https://github.com/assetnote/kiterunner.git cd kiterunner make build sudo mv dist/kr /usr/local/bin/ Verify installation: kr -h We have installed kiterunner and now we will get some hands on experience. Finding API Endpoints with Kiterunner : 1. Choose the Right Wordlist Kiterunner requires wordlists optimized for API discovery. Assetnote provides excellent wordlists: wget https://wordlists-cdn.assetnote.io/data/kiterunner/routes-large.kite You can also use routes-small.kite for faster scans. 2. Start Scanning a Target : Run a brute-force scan against an API: kr scan -w routes-large.kite -u https://api.target.com -w: Specifies the wordlist -u: Target API URL 3. Using Authentication Headers If the API requires authentication, add the headers: kr scan -w routes-large.kite -u https://api.target.com -H "Authorization: Bearer YOUR_ACCESS_TOKEN" 4. Concurrent Requests for Faster Scanning : Increase the number of threads for speed: kr scan -w routes-large.kite -u https://api.target.com -c 50 -c: Number of concurrent requests (default is 25) 5. Output Results to a File To save discovered endpoints: kr scan -w routes-large.kite -u https://api.target.com -o results.json Analyzing the Results : The results will contain: Endpoints: Discovered API paths Response Codes: 200 (OK), 403 (Forbidden), 500 (Server Error), etc. Response Size: Helps detect meaningful responses Example output: { "path": "/v1/user/info", "status": 200, "length": 512, "words": 50 } Look for endpoints returning 200 OK or 403 Forbidden, as they often lead to sensitive data or functions. Advanced Usage : 1. Fuzzing Different HTTP Methods By default, Kiterunner uses GET. To test other methods like POST, PUT, etc.: kr scan -w routes-large.kite -u https://api.target.com -m POST 2. Testing Different Base Paths Some APIs use non-standard base paths like /api/v2/: kr scan -w routes-large.kite -u https://api.target.com/api/v2/ 3. Chaining with Other Tools Combine with Burp Suite for deeper analysis by importing results. Kiterunner is a must-have tool for API recon, especially for bug bounty hunters. With its ability to detect hidden endpoints, undocumented API routes, and authentication-protected paths, it significantly expands your attack surface. Try it on public APIs and improve your recon ! Subscribe To My Newsletter : https://spectatorguy.beehiiv.com/subscribe Follow me on X : https://x.com/spectat0rguy?t=bp6JxuQNWR Buy me a Coffee ☕ : https://buymeacoffee.com/spectatorguy API Endpoints Discovery using Kiterunner was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.