Where do I get kiterunner and its wordlists?

The tool is Assetnote's open-source kr binary at github.com/assetnote/kiterunner. For wordlists, point --assetnote-wordlist at a named list from wordlist.assetnote.io, e.g. apiroutes-210228, or supply your own with -w or a kitebuilder list with --kitebuilder-list.

What is the difference between scan and brute mode?

scan runs kitebuilder route schemas against the hosts, replaying the exact method, headers, and body each route expects. brute enumerates paths from a plain wordlist and appends extensions with --extensions, closer to a classic directory brute-force.

How does kiterunner find API endpoints a normal fuzzer misses?

It works from kitebuilder schemas compiled from OpenAPI and Swagger definitions, so a request for /api/v2/orders/{id} goes out as the right verb with the right content type. A blind GET wordlist never reproduces those requirements, so those routes stay hidden.

How do I cut false positives on a large scan?

kiterunner runs preflight checks and quarantines hosts that return too many consecutive hits as wildcards, tuned with --quarantine-threshold. Add --ignore-length to drop responses whose byte length matches a known noise range, and --preflight-depth to control how deep the wildcard check probes.

Can kiterunner replay or convert kitebuilder schemas?

Yes. The kb subcommands parse, convert, compile, and replay kitebuilder schemas: parse prints a schema, convert changes its format, compile writes a binary wordlist, and replay reissues a stored request so you can inspect a single hit by hand.

Updated Jul 15, 2026

Discovery

Brute-force API routes and endpoints in modern apps

Lightning-fast content discovery that also brute-forces routes and endpoints in modern applications.

Brute-force modern API routes Run fast content discovery Use the Assetnote wordlists

overview

What kiterunner does

kiterunner does content discovery at high speed, but its strength is API routes. It reads kitebuilder schemas built from real API definitions, so it sends requests with the methods, headers, and paths a modern endpoint expects instead of blind GETs against a directory wordlist.

Scan mode replays those schema-aware requests; brute mode enumerates paths from a plain wordlist; and either can pull curated route lists straight from the Assetnote research wordlists. Preflight checks, wildcard quarantine, content-length filtering, and per-host concurrency limits keep large runs accurate without drowning a target.

In a Trickest workflow it takes a file of target hosts and writes a file and a folder of discovered routes. Chain it after a prober that confirms live hosts, then feed the routes it surfaces into a parameter or vulnerability stage.

source github.com/assetnote/kiterunner

use cases

Where kiterunner fits

Brute-force modern API routes

Scan hosts with kitebuilder schemas so requests carry the right methods and headers, surfacing API endpoints a plain directory brute-force never finds.

Run fast content discovery

Use brute mode with a wordlist and extensions to enumerate paths at speed across a list of target hosts.

Use the Assetnote wordlists

Pull a named Assetnote API-routes wordlist directly so the scan draws on curated, research-backed route lists without hosting them yourself.

Keep wide runs accurate

Tune the ignore-length filter and wildcard quarantine threshold so wildcard responses and noise do not flood the results on a large scan.

reference

kiterunner inputs and flags

42 inputs

Name	Type	Flag	Description
hosts	FILE	·	File of target hosts to scan.
scan-mode	BOOLEAN	scan	Scan mode: replay kitebuilder route schemas against the hosts.
brute-mode	BOOLEAN	brute	Bruteforce mode: enumerate paths from a plain wordlist.
wordlist	FILE	-w	Normal or ogl wordlist to use for scanning.
assetnote-wordlist	STRING	--assetnote-wordlist	Pull a named Assetnote wordlist, e.g. apiroutes-210228.
kitebuilder-list	FILE	--kitebuilder-list	Ogl (kitebuilder) wordlist to use for scanning.
output	STRING	--output	Output format: json, text, or pretty (default pretty).
max-parallel-hosts	STRING	--max-parallel-hosts	Max number of concurrent hosts to scan at once (default 50).

Showing key inputs. kiterunner exposes 42 inputs in total.

Full flag reference (42 inputs)

Name	Type	Flag	Description
delay	STRING	--delay	Delay to place in between requests to a single host.
hosts	FILE	·	Target hosts to scan (positional input).
quiet	BOOLEAN	--quiet	Quiet mode; mute unnecessary pretty text.
header	STRING	--header	Headers to add to requests (default x-forwarded-for: 127.0.0.1).
output	STRING	--output	Output format: json, text, or pretty (default pretty).
kb-mode	BOOLEAN	kb	kb mode; manipulate the kitebuilder schema.
timeout	STRING	--timeout	Timeout to use on all requests (default 3s).
verbose	STRING	--verbose	Logging verbosity: error, info, debug, or trace (default info).
wordlist	FILE	-w	Normal or ogl wordlist to use for scanning.
scan-mode	BOOLEAN	scan	Scan mode; run route schemas against the target hosts.
brute-mode	BOOLEAN	brute	Bruteforce mode; enumerate paths from a plain wordlist.
filter-api	STRING	--filter-api	Only scan APIs matching this ksuid.
user-agent	STRING	--user-agent	User agent to use for requests (defaults to a Chrome UA).
config-file	FILE	--config	Specify the config file.
force-method	STRING	--force-method	Ignore the methods in the ogl file and force this method.
profile-name	STRING	--profile-name	Name for the profile output file.
ignore-length	STRING	--ignore-length	Content-length byte ranges to ignore, e.g. 100-105 or 123,34-53 (inclusive).
kb-mode-debug	BOOLEAN	-d	Debug mode; convert the schema with error handling.
kb-mode-parse	FILE	parse	Parse a kitebuilder schema and print the prettified data.
max-redirects	STRING	--max-redirects	Maximum number of redirects to follow (default 3).
wordlist-mode	BOOLEAN	wordlist	Wordlist mode; inspect cached and remote wordlists.
kb-mode-replay	STRING	replay	Replay a kitebuilder request based on the input.
kb-mode-convert	FILE	convert	Convert an input file format into the specified output format.
preflight-depth	STRING	--preflight-depth	Directory depth to check during preflight; 0 checks only the docroot (default 1).
blacklist-domain	STRING	--blacklist-domain	Domains blacklisted for redirects; redirects to these are not followed.
disable-precheck	BOOLEAN	--disable-precheck	Skip host discovery.
kitebuilder-list	FILE	--kitebuilder-list	Ogl wordlist to use for scanning.
fail-status-codes	STRING	--fail-status-codes	Status codes to treat as failure; overrides success-status-codes when set.
assetnote-wordlist	STRING	--assetnote-wordlist	Use a wordlist from wordlist.assetnote.io by type/name, e.g. apiroutes-210228; append ;N to cap it to the first N lines.
max-parallel-hosts	STRING	--max-parallel-hosts	Max number of concurrent hosts to scan at once (default 50).
wildcard-detection	STRING	--wildcard-detection	Set to false to disable wildcard redirect detection (default true).
wordlist-mode-list	BOOLEAN	list	List the wordlists cached and available.
wordlist-mode-save	STRING	save	Save the wordlists specified (full filename or alias).
quarantine-threshold	STRING	--quarantine-threshold	Quarantine a host as wildcard after N consecutive hits; 0 disables (default 10).
success-status-codes	STRING	--success-status-codes	Status codes to treat as success; this is the default mode.
brute-mode-extensions	STRING	--extensions	Extensions to append while scanning.
kitebuilder-full-scan	BOOLEAN	--kitebuilder-full-scan	Perform a full scan without first running a phase scan.
max-connection-per-host	STRING	--max-connection-per-host	Max connections to a single host (default 3).
kb-mode-compile-wordlist	FILE	compile	Compile a kitebuilder schema and write the data to the specified file.
brute-mode-dirsearch-compat	BOOLEAN	--dirsearch-compat	Replace %EXT% with the provided extensions for dirsearch compatibility.
kb-mode-compile-output-file	STRING	·	Output file for the compiled kitebuilder schema (kb compile).
kb-mode-convert-output-file-format	STRING	·	kb convert mode output file format.

example

Run kiterunner

kiterunner · command

# kiterunner (kr): scan hosts with an Assetnote API-routes wordlist, JSON outputkr scan hosts.txt --assetnote-wordlist apiroutes-210228 --output json --ignore-length 34

sample output

GET     200 [    1876,   402,   58] https://example.com/api/v1/users             apiroutes-210228 90a3c1f7POST    405 [     167,     9,    2] https://example.com/api/v1/auth/login        apiroutes-210228 5e2b8d04GET     403 [     284,    14,    5] https://example.com/api/v2/admin/config      apiroutes-210228 c47af9b1PUT     401 [     122,     7,    1] https://example.com/api/v1/orders/{id}       apiroutes-210228 1fd6e880GET     200 [    9210,  1204,  173] https://example.com/api/v1/products          apiroutes-210228 7ac0b3e2DELETE  204 [       0,     0,    0] https://example.com/api/v2/sessions/{token}  apiroutes-210228 b93c1a55GET     500 [     841,    52,   11] https://example.com/api/internal/debug       apiroutes-210228 e0d47f26GET     200 [    3480,   410,   62] https://example.com/api/v3/docs              apiroutes-210228 4b1e9f37

guidance

Choosing kiterunner

Use kiterunner when the target exposes an API and you want route discovery that sends real, schema-aware requests. It discovers routes, it does not test them for flaws, so feed live hosts in and pass found routes out. For path and file brute-forcing of classic apps, ffuf or feroxbuster fit better.

ffuf

General FUZZ engine for paths, params, and vhosts. kiterunner is API-route-aware with kitebuilder schemas.

feroxbuster

Recursive content discovery with smart defaults. kiterunner targets modern API endpoints specifically.

dirsearch

Classic directory and file brute-forcer. kiterunner adds method-aware API route discovery.

faq

kiterunner questions

kiterunner does fast content discovery and, more to the point, brute-forces API routes and endpoints in modern applications. It sends schema-aware requests derived from real API definitions, so it surfaces routes that a directory-style scan tends to miss.

Run kiterunner yourself

A host list and a wordlist feed kiterunner, which brute-forces API routes and writes the discovered endpoints as a queryable output.

Run kiterunner in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

hosts

FILE

File of target hosts to scan.

scan-mode

BOOLEAN

scan

Scan mode: replay kitebuilder route schemas against the hosts.

brute-mode

BOOLEAN

brute

Bruteforce mode: enumerate paths from a plain wordlist.

wordlist

FILE

-w

Normal or ogl wordlist to use for scanning.

assetnote-wordlist

STRING

--assetnote-wordlist

Pull a named Assetnote wordlist, e.g. apiroutes-210228.

kitebuilder-list

FILE

--kitebuilder-list

Ogl (kitebuilder) wordlist to use for scanning.

output

STRING

--output

Output format: json, text, or pretty (default pretty).

max-parallel-hosts

STRING

--max-parallel-hosts

Max number of concurrent hosts to scan at once (default 50).

Name

Type

Flag

Description

delay

STRING

--delay

Delay to place in between requests to a single host.

hosts

FILE

Target hosts to scan (positional input).

quiet

BOOLEAN

--quiet

Quiet mode; mute unnecessary pretty text.

header

STRING

--header

Headers to add to requests (default x-forwarded-for: 127.0.0.1).

output

STRING

--output

Output format: json, text, or pretty (default pretty).

kb-mode

BOOLEAN

kb mode; manipulate the kitebuilder schema.

timeout

STRING

--timeout

Timeout to use on all requests (default 3s).

verbose

STRING

--verbose

Logging verbosity: error, info, debug, or trace (default info).

wordlist

FILE

-w

Normal or ogl wordlist to use for scanning.

scan-mode

BOOLEAN

scan

Scan mode; run route schemas against the target hosts.

brute-mode

BOOLEAN

brute

Bruteforce mode; enumerate paths from a plain wordlist.

filter-api

STRING

--filter-api

Only scan APIs matching this ksuid.

user-agent

STRING

--user-agent

User agent to use for requests (defaults to a Chrome UA).

config-file

FILE

--config

Specify the config file.

force-method

STRING

--force-method

Ignore the methods in the ogl file and force this method.

profile-name

STRING

--profile-name

Name for the profile output file.

ignore-length

STRING

--ignore-length

Content-length byte ranges to ignore, e.g. 100-105 or 123,34-53 (inclusive).

kb-mode-debug

BOOLEAN

-d

Debug mode; convert the schema with error handling.

kb-mode-parse

FILE

parse

Parse a kitebuilder schema and print the prettified data.

max-redirects

STRING

--max-redirects

Maximum number of redirects to follow (default 3).

wordlist-mode

BOOLEAN

wordlist

Wordlist mode; inspect cached and remote wordlists.

kb-mode-replay

STRING

replay

Replay a kitebuilder request based on the input.

kb-mode-convert

FILE

convert

Convert an input file format into the specified output format.

preflight-depth

STRING

--preflight-depth

Directory depth to check during preflight; 0 checks only the docroot (default 1).

blacklist-domain

STRING

--blacklist-domain

Domains blacklisted for redirects; redirects to these are not followed.

disable-precheck

BOOLEAN

--disable-precheck

Skip host discovery.

kitebuilder-list

FILE

--kitebuilder-list

Ogl wordlist to use for scanning.

fail-status-codes

STRING

--fail-status-codes

Status codes to treat as failure; overrides success-status-codes when set.

assetnote-wordlist

STRING

--assetnote-wordlist

Use a wordlist from wordlist.assetnote.io by type/name, e.g. apiroutes-210228; append ;N to cap it to the first N lines.

max-parallel-hosts

STRING

--max-parallel-hosts

Max number of concurrent hosts to scan at once (default 50).

wildcard-detection

STRING

--wildcard-detection

Set to false to disable wildcard redirect detection (default true).

wordlist-mode-list

BOOLEAN

list

List the wordlists cached and available.

wordlist-mode-save

STRING

save

Save the wordlists specified (full filename or alias).

quarantine-threshold

STRING

--quarantine-threshold

Quarantine a host as wildcard after N consecutive hits; 0 disables (default 10).

success-status-codes

STRING

--success-status-codes

Status codes to treat as success; this is the default mode.

brute-mode-extensions

STRING

--extensions

Extensions to append while scanning.

kitebuilder-full-scan

BOOLEAN

--kitebuilder-full-scan

Perform a full scan without first running a phase scan.

max-connection-per-host

STRING

--max-connection-per-host

Max connections to a single host (default 3).

kb-mode-compile-wordlist

FILE

compile

Compile a kitebuilder schema and write the data to the specified file.

brute-mode-dirsearch-compat

BOOLEAN

--dirsearch-compat

Replace %EXT% with the provided extensions for dirsearch compatibility.

kb-mode-compile-output-file

STRING

Output file for the compiled kitebuilder schema (kb compile).

kb-mode-convert-output-file-format

STRING

kb convert mode output file format.

GET 200 [ 1876, 402, 58] https://example.com/api/v1/users apiroutes-210228 90a3c1f7POST 405 [ 167, 9, 2] https://example.com/api/v1/auth/login apiroutes-210228 5e2b8d04GET 403 [ 284, 14, 5] https://example.com/api/v2/admin/config apiroutes-210228 c47af9b1PUT 401 [ 122, 7, 1] https://example.com/api/v1/orders/{id} apiroutes-210228 1fd6e880GET 200 [ 9210, 1204, 173] https://example.com/api/v1/products apiroutes-210228 7ac0b3e2DELETE 204 [ 0, 0, 0] https://example.com/api/v2/sessions/{token} apiroutes-210228 b93c1a55GET 500 [ 841, 52, 11] https://example.com/api/internal/debug apiroutes-210228 e0d47f26GET 200 [ 3480, 410, 62] https://example.com/api/v3/docs apiroutes-210228 4b1e9f37

Brute-force API routes and endpoints in modern apps

What kiterunner does

Where kiterunner fits

Brute-force modern API routes

Run fast content discovery

Use the Assetnote wordlists

Keep wide runs accurate

kiterunner inputs and flags

Run kiterunner

Choosing kiterunner

ffuf

feroxbuster

dirsearch

kiterunner questions

More Discovery tools

404checker

anew

apkurlgrep

aquatone

aws-s3-data-finder

bfac

Run kiterunner yourself

Brute-force API routes and endpoints in modern apps

What kiterunner does

Where kiterunner fits

Brute-force modern API routes

Run fast content discovery

Use the Assetnote wordlists

Keep wide runs accurate

kiterunner inputs and flags

Run kiterunner

Choosing kiterunner

ffuf

feroxbuster

dirsearch

kiterunner questions

More Discovery tools

404checker

anew

apkurlgrep

aquatone

aws-s3-data-finder

bfac

Run kiterunner yourself