How does kiterunner find API endpoints a normal fuzzer misses?

It works from kitebuilder schemas compiled from OpenAPI and Swagger definitions, so a request for an API path goes out as the right verb with the right content type. A blind GET wordlist never reproduces those requirements.

How do I cut false positives on a large scan?

Preflight checks quarantine hosts that return too many consecutive hits as wildcards, tuned with --quarantine-threshold. Add --ignore-length to drop responses whose byte length matches known noise, and --preflight-depth to control how deep the wildcard check probes.

Where do wordlists come from?

Point --assetnote-wordlist at a named list such as apiroutes-210228, supply your own with -w, or use a kitebuilder list with --kitebuilder-list. Choose --output json, text, or pretty for result format.

How does kiterunner compare with ffuf?

ffuf is a general FUZZ engine for paths, params, and vhosts. kiterunner is API-route-aware: scan mode sends schema-shaped requests instead of blind GETs against a directory wordlist.

Updated Jul 15, 2026

Discovery

Discover method-aware API routes on live hosts

Schema-aware API route discovery for modern apps.

Brute-force modern API routes Run fast content discovery Use the Assetnote wordlists

overview

What kiterunner does

kiterunner finds API routes that plain directory brute-force misses. Scan mode replays kitebuilder schemas with the methods, headers, and paths a modern endpoint expects; brute mode enumerates paths from a wordlist with -w.

Use it when hosts look API-shaped and you need route inventory before parameter or vulnerability work. Pull curated lists with --assetnote-wordlist or supply --kitebuilder-list. Tune --ignore-length and --quarantine-threshold so wildcard noise does not flood results.

Feed live hosts from a prober, then pass discovered routes into a later stage. The node takes a hosts file and writes FILE plus FOLDER. Prefer ffuf or feroxbuster for classic path and file brute-force.

source github.com/assetnote/kiterunner

use cases

Where kiterunner fits

Brute-force modern API routes

Scan hosts with kitebuilder schemas so requests carry the right methods and headers, surfacing API endpoints a plain directory brute-force never finds.

Run fast content discovery

Use brute mode with a wordlist and extensions to enumerate paths at speed across a list of target hosts.

Use the Assetnote wordlists

Pull a named Assetnote API-routes wordlist directly so the scan draws on curated, research-backed route lists without hosting them yourself.

Keep wide runs accurate

Tune the ignore-length filter and wildcard quarantine threshold so wildcard responses and noise do not flood the results on a large scan.

reference

kiterunner inputs and flags

42 inputs

Name	Type	Flag	Description
hosts	FILE	·	File of target hosts to scan.
scan-mode	BOOLEAN	scan	Scan mode: replay kitebuilder route schemas against the hosts.
brute-mode	BOOLEAN	brute	Bruteforce mode: enumerate paths from a plain wordlist.
wordlist	FILE	-w	Normal or ogl wordlist to use for scanning.
assetnote-wordlist	STRING	--assetnote-wordlist	Pull a named Assetnote wordlist, e.g. apiroutes-210228.
kitebuilder-list	FILE	--kitebuilder-list	Ogl (kitebuilder) wordlist to use for scanning.
output	STRING	--output	Output format: json, text, or pretty (default pretty).
max-parallel-hosts	STRING	--max-parallel-hosts	Max number of concurrent hosts to scan at once (default 50).

Showing key inputs. kiterunner exposes 42 inputs in total.

Full flag reference (42 inputs)

Name	Type	Flag	Description
delay	STRING	--delay	Delay to place in between requests to a single host.
hosts	FILE	·	Target hosts to scan (positional input).
quiet	BOOLEAN	--quiet	Quiet mode; mute unnecessary pretty text.
header	STRING	--header	Headers to add to requests (default x-forwarded-for: 127.0.0.1).
output	STRING	--output	Output format: json, text, or pretty (default pretty).
kb-mode	BOOLEAN	kb	kb mode; manipulate the kitebuilder schema.
timeout	STRING	--timeout	Timeout to use on all requests (default 3s).
verbose	STRING	--verbose	Logging verbosity: error, info, debug, or trace (default info).
wordlist	FILE	-w	Normal or ogl wordlist to use for scanning.
scan-mode	BOOLEAN	scan	Scan mode; run route schemas against the target hosts.
brute-mode	BOOLEAN	brute	Bruteforce mode; enumerate paths from a plain wordlist.
filter-api	STRING	--filter-api	Only scan APIs matching this ksuid.
user-agent	STRING	--user-agent	User agent to use for requests (defaults to a Chrome UA).
config-file	FILE	--config	Specify the config file.
force-method	STRING	--force-method	Ignore the methods in the ogl file and force this method.
profile-name	STRING	--profile-name	Name for the profile output file.
ignore-length	STRING	--ignore-length	Content-length byte ranges to ignore, e.g. 100-105 or 123,34-53 (inclusive).
kb-mode-debug	BOOLEAN	-d	Debug mode; convert the schema with error handling.
kb-mode-parse	FILE	parse	Parse a kitebuilder schema and print the prettified data.
max-redirects	STRING	--max-redirects	Maximum number of redirects to follow (default 3).
wordlist-mode	BOOLEAN	wordlist	Wordlist mode; inspect cached and remote wordlists.
kb-mode-replay	STRING	replay	Replay a kitebuilder request based on the input.
kb-mode-convert	FILE	convert	Convert an input file format into the specified output format.
preflight-depth	STRING	--preflight-depth	Directory depth to check during preflight; 0 checks only the docroot (default 1).
blacklist-domain	STRING	--blacklist-domain	Domains blacklisted for redirects; redirects to these are not followed.
disable-precheck	BOOLEAN	--disable-precheck	Skip host discovery.
kitebuilder-list	FILE	--kitebuilder-list	Ogl wordlist to use for scanning.
fail-status-codes	STRING	--fail-status-codes	Status codes to treat as failure; overrides success-status-codes when set.
assetnote-wordlist	STRING	--assetnote-wordlist	Use a wordlist from wordlist.assetnote.io by type/name, e.g. apiroutes-210228; append ;N to cap it to the first N lines.
max-parallel-hosts	STRING	--max-parallel-hosts	Max number of concurrent hosts to scan at once (default 50).
wildcard-detection	STRING	--wildcard-detection	Set to false to disable wildcard redirect detection (default true).
wordlist-mode-list	BOOLEAN	list	List the wordlists cached and available.
wordlist-mode-save	STRING	save	Save the wordlists specified (full filename or alias).
quarantine-threshold	STRING	--quarantine-threshold	Quarantine a host as wildcard after N consecutive hits; 0 disables (default 10).
success-status-codes	STRING	--success-status-codes	Status codes to treat as success; this is the default mode.
brute-mode-extensions	STRING	--extensions	Extensions to append while scanning.
kitebuilder-full-scan	BOOLEAN	--kitebuilder-full-scan	Perform a full scan without first running a phase scan.
max-connection-per-host	STRING	--max-connection-per-host	Max connections to a single host (default 3).
kb-mode-compile-wordlist	FILE	compile	Compile a kitebuilder schema and write the data to the specified file.
brute-mode-dirsearch-compat	BOOLEAN	--dirsearch-compat	Replace %EXT% with the provided extensions for dirsearch compatibility.
kb-mode-compile-output-file	STRING	·	Output file for the compiled kitebuilder schema (kb compile).
kb-mode-convert-output-file-format	STRING	·	kb convert mode output file format.

example

Run kiterunner

kiterunner · command

# kiterunner (kr): scan hosts with an Assetnote API-routes wordlist, JSON outputkr scan hosts.txt --assetnote-wordlist apiroutes-210228 --output json --ignore-length 34

sample output

GET     200 [    1876,   402,   58] https://example.com/api/v1/users             apiroutes-210228 90a3c1f7POST    405 [     167,     9,    2] https://example.com/api/v1/auth/login        apiroutes-210228 5e2b8d04GET     403 [     284,    14,    5] https://example.com/api/v2/admin/config      apiroutes-210228 c47af9b1PUT     401 [     122,     7,    1] https://example.com/api/v1/orders/{id}       apiroutes-210228 1fd6e880GET     200 [    9210,  1204,  173] https://example.com/api/v1/products          apiroutes-210228 7ac0b3e2DELETE  204 [       0,     0,    0] https://example.com/api/v2/sessions/{token}  apiroutes-210228 b93c1a55GET     500 [     841,    52,   11] https://example.com/api/internal/debug       apiroutes-210228 e0d47f26GET     200 [    3480,   410,   62] https://example.com/api/v3/docs              apiroutes-210228 4b1e9f37

guidance

Choosing kiterunner

Use kiterunner when the target exposes an API and you want schema-aware route discovery. It finds routes; it does not test them for flaws. For classic directory and file brute-force, prefer ffuf or feroxbuster.

ffuf

General FUZZ engine for paths, params, and vhosts. kiterunner is API-route-aware with kitebuilder schemas.

feroxbuster

Recursive content discovery with smart defaults. kiterunner targets modern API endpoints specifically.

dirsearch

Classic directory and file brute-forcer. kiterunner adds method-aware API route discovery.

faq

kiterunner questions

scan replays kitebuilder route schemas against hosts with the method, headers, and body each route expects. brute enumerates paths from a plain wordlist (-w) and can append --extensions, closer to classic directory brute-force.

Run kiterunner yourself

A host list and a wordlist feed kiterunner, which brute-forces API routes and writes the discovered endpoints as a queryable output.

Run kiterunner in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

hosts

FILE

File of target hosts to scan.

scan-mode

BOOLEAN

scan

Scan mode: replay kitebuilder route schemas against the hosts.

brute-mode

BOOLEAN

brute

Bruteforce mode: enumerate paths from a plain wordlist.

wordlist

FILE

-w

Normal or ogl wordlist to use for scanning.

assetnote-wordlist

STRING

--assetnote-wordlist

Pull a named Assetnote wordlist, e.g. apiroutes-210228.

kitebuilder-list

FILE

--kitebuilder-list

Ogl (kitebuilder) wordlist to use for scanning.

output

STRING

--output

Output format: json, text, or pretty (default pretty).

max-parallel-hosts

STRING

--max-parallel-hosts

Max number of concurrent hosts to scan at once (default 50).

Name

Type

Flag

Description

delay

STRING

--delay

Delay to place in between requests to a single host.

hosts

FILE

Target hosts to scan (positional input).

quiet

BOOLEAN

--quiet

Quiet mode; mute unnecessary pretty text.

header

STRING

--header

Headers to add to requests (default x-forwarded-for: 127.0.0.1).

output

STRING

--output

Output format: json, text, or pretty (default pretty).

kb-mode

BOOLEAN

kb mode; manipulate the kitebuilder schema.

timeout

STRING

--timeout

Timeout to use on all requests (default 3s).

verbose

STRING

--verbose

Logging verbosity: error, info, debug, or trace (default info).

wordlist

FILE

-w

Normal or ogl wordlist to use for scanning.

scan-mode

BOOLEAN

scan

Scan mode; run route schemas against the target hosts.

brute-mode

BOOLEAN

brute

Bruteforce mode; enumerate paths from a plain wordlist.

filter-api

STRING

--filter-api

Only scan APIs matching this ksuid.

user-agent

STRING

--user-agent

User agent to use for requests (defaults to a Chrome UA).

config-file

FILE

--config

Specify the config file.

force-method

STRING

--force-method

Ignore the methods in the ogl file and force this method.

profile-name

STRING

--profile-name

Name for the profile output file.

ignore-length

STRING

--ignore-length

Content-length byte ranges to ignore, e.g. 100-105 or 123,34-53 (inclusive).

kb-mode-debug

BOOLEAN

-d

Debug mode; convert the schema with error handling.

kb-mode-parse

FILE

parse

Parse a kitebuilder schema and print the prettified data.

max-redirects

STRING

--max-redirects

Maximum number of redirects to follow (default 3).

wordlist-mode

BOOLEAN

wordlist

Wordlist mode; inspect cached and remote wordlists.

kb-mode-replay

STRING

replay

Replay a kitebuilder request based on the input.

kb-mode-convert

FILE

convert

Convert an input file format into the specified output format.

preflight-depth

STRING

--preflight-depth

Directory depth to check during preflight; 0 checks only the docroot (default 1).

blacklist-domain

STRING

--blacklist-domain

Domains blacklisted for redirects; redirects to these are not followed.

disable-precheck

BOOLEAN

--disable-precheck

Skip host discovery.

kitebuilder-list

FILE

--kitebuilder-list

Ogl wordlist to use for scanning.

fail-status-codes

STRING

--fail-status-codes

Status codes to treat as failure; overrides success-status-codes when set.

assetnote-wordlist

STRING

--assetnote-wordlist

Use a wordlist from wordlist.assetnote.io by type/name, e.g. apiroutes-210228; append ;N to cap it to the first N lines.

max-parallel-hosts

STRING

--max-parallel-hosts

Max number of concurrent hosts to scan at once (default 50).

wildcard-detection

STRING

--wildcard-detection

Set to false to disable wildcard redirect detection (default true).

wordlist-mode-list

BOOLEAN

list

List the wordlists cached and available.

wordlist-mode-save

STRING

save

Save the wordlists specified (full filename or alias).

quarantine-threshold

STRING

--quarantine-threshold

Quarantine a host as wildcard after N consecutive hits; 0 disables (default 10).

success-status-codes

STRING

--success-status-codes

Status codes to treat as success; this is the default mode.

brute-mode-extensions

STRING

--extensions

Extensions to append while scanning.

kitebuilder-full-scan

BOOLEAN

--kitebuilder-full-scan

Perform a full scan without first running a phase scan.

max-connection-per-host

STRING

--max-connection-per-host

Max connections to a single host (default 3).

kb-mode-compile-wordlist

FILE

compile

Compile a kitebuilder schema and write the data to the specified file.

brute-mode-dirsearch-compat

BOOLEAN

--dirsearch-compat

Replace %EXT% with the provided extensions for dirsearch compatibility.

kb-mode-compile-output-file

STRING

Output file for the compiled kitebuilder schema (kb compile).

kb-mode-convert-output-file-format

STRING

kb convert mode output file format.

GET 200 [ 1876, 402, 58] https://example.com/api/v1/users apiroutes-210228 90a3c1f7POST 405 [ 167, 9, 2] https://example.com/api/v1/auth/login apiroutes-210228 5e2b8d04GET 403 [ 284, 14, 5] https://example.com/api/v2/admin/config apiroutes-210228 c47af9b1PUT 401 [ 122, 7, 1] https://example.com/api/v1/orders/{id} apiroutes-210228 1fd6e880GET 200 [ 9210, 1204, 173] https://example.com/api/v1/products apiroutes-210228 7ac0b3e2DELETE 204 [ 0, 0, 0] https://example.com/api/v2/sessions/{token} apiroutes-210228 b93c1a55GET 500 [ 841, 52, 11] https://example.com/api/internal/debug apiroutes-210228 e0d47f26GET 200 [ 3480, 410, 62] https://example.com/api/v3/docs apiroutes-210228 4b1e9f37

Discover method-aware API routes on live hosts

What kiterunner does

Where kiterunner fits

Brute-force modern API routes

Run fast content discovery

Use the Assetnote wordlists

Keep wide runs accurate

kiterunner inputs and flags

Run kiterunner

Choosing kiterunner

ffuf

feroxbuster

dirsearch

kiterunner questions

More Discovery tools

apkurlgrep

dirsearch

fallparams

feroxbuster

gauplus

getJS

Run kiterunner yourself

Discover method-aware API routes on live hosts

What kiterunner does

Where kiterunner fits

Brute-force modern API routes

Run fast content discovery

Use the Assetnote wordlists

Keep wide runs accurate

kiterunner inputs and flags

Run kiterunner

Choosing kiterunner

ffuf

feroxbuster

dirsearch

kiterunner questions

More Discovery tools

apkurlgrep

dirsearch

fallparams

feroxbuster

gauplus

getJS

Run kiterunner yourself