Kiterunner is a content discovery tool that bruteforces API endpoints in modern web applications by leveraging structured knowledge of how frameworks define routes.
Traditional content discovery tools treat all endpoints as static files and paths, missing the majority of API routes that modern frameworks like Flask, Rails, Express, and Django explicitly define with specific HTTP methods, headers, parameters, and expected values. Kiterunner solves this by collating Swagger specifications from internet-wide scans, GitHub, and APIs.guru into a condensed schema, then using that dataset to send properly formed requests with correct methods, headers, paths, parameters, and values. This approach discovers endpoints that traditional tools cannot find while maintaining lightning-fast scanning speeds.
Kiterunner suits security researchers and penetration testers performing API reconnaissance on modern applications. It works best when targeting frameworks that follow explicit route definition patterns rather than legacy static file servers. The tool offers multiple scanning modes: API scanning using its Swagger-derived dataset, vanilla bruteforcing with custom wordlists, and dirsearch-style bruteforcing. It supports depth scanning to explore nested endpoints, provides adjustable concurrency settings for speed optimization, and includes request replay functionality. The project provides both raw JSON datasets and pre-compiled kite format files to reduce setup overhead.
The project maintains active development with regular updates to its endpoint dataset and tooling. The codebase is written in Go, enabling the high-speed concurrent scanning that distinguishes it from slower alternatives. The tool includes conversion utilities between different file formats and supports integration with external wordlists, indicating ongoing refinement of its workflow. Documentation covers technical implementation details including the intermediate PRoutes data type and the kite file format specification.
