# Kiterunner: content discovery built for APIs

> How to install and run Kiterunner, why it beats generic directory brute-forcers on modern APIs, and how Tandera uses it for shadow-endpoint discovery.

`Kiterunner` is content discovery designed for APIs rather than websites. Generic brute-forcers send `GET /path`; real APIs use specific methods, headers, path parameters and content types. Kiterunner replays request templates derived from tens of thousands of real API specifications, so it finds routes that only respond to, say, `POST` with a JSON body.

## Install

```bash
# binary release
wget https://github.com/assetnote/kiterunner/releases/latest/download/kiterunner_linux_amd64.tar.gz
tar xf kiterunner_linux_amd64.tar.gz && sudo mv kr /usr/local/bin/

# wordlists (Assetnote's routes-* kite files)
wget https://wordlists-cdn.assetnote.io/data/kiterunner/routes-large.kite
```

## Core commands

```bash
# scan with a kite wordlist
kr scan https://api.example.com -w routes-large.kite

# a list of hosts
kr scan hosts.txt -w routes-large.kite -o json -O results.json

# carry an auth header
kr scan https://api.example.com -w routes-large.kite \
  -H "Authorization: Bearer TOKEN"

# tune concurrency and rate
kr scan https://api.example.com -w routes-large.kite \
  --max-connection-per-host 5 -x 10
```

## Output

```json
{"method":"POST","path":"/api/v2/users/import","status":401,"content_length":52,
 "host":"https://api.example.com"}
```

A `401` here is a signal, not a failure: the route exists and requires auth.

## Where it sits in Tandera

Kiterunner runs in the **analyze** phase of `recon_api`. Its results feed the flow's shadow-endpoint synthesis — routes it discovers are compared against the API's documented specification, and anything present but undocumented is surfaced as shadow surface.

## Using it in a pentest

**401 and 403 are the interesting results, not 200.** They mean the endpoint exists and is protected. An undocumented endpoint that requires auth is precisely where broken object-level authorisation tends to live — test it with and without credentials.

**Match the method, or you find nothing.** The reason generic brute-forcers miss API routes is that they only send GET. Kiterunner's method awareness is the point; do not fall back to a GET-only wordlist against an API.

**Diff against the spec.** If the client provided an OpenAPI document, the gap between what it documents and what Kiterunner finds is the shadow API — undocumented, and usually less tested.

**Rate-limit against production.** The route lists are large. Cap connections and coordinate the window with the client.

---

Canonical: https://tandera.io/tools/kiterunner
This page as markdown: https://tandera.io/tools/kiterunner.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.