aeondave/kiterunner
offensive-tools/api/kiterunner/SKILL.md
Context-aware API route discovery and brute-forcing using real-world API schema wordlists. Use when enumerating API endpoints, discovering hidden routes on REST/gRPC services, or replacing dirbusting for API surfaces.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill kiterunnerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 31, 2026, 8:57 PM56.8s1 file scanned
SKILL.md
- name:
- kiterunner
- description:
- Context-aware API route discovery and brute-forcing using real-world API schema wordlists. Use when enumerating API endpoints, discovering hidden routes on REST/gRPC services, or replacing dirbusting for API surfaces.
- license:
- MIT
- compatibility:
- Go binary; Linux/macOS/Windows; github.com/assetnote/kiterunner
- author:
- AeonDave
- version:
- 1.0
Kiterunner
Context-aware API route brute-forcer using real-world API schema wordlists (Assetnote).
Quick Start
# Download binary from https://github.com/assetnote/kiterunner/releases
# Scan with default wordlist
kr scan https://target.com -w routes-small.kite
# Scan from file of hosts
kr scan hosts.txt -w routes-large.kite -x 20
# Replay a finding with full request detail
kr replay -w routes-small.kite "GET 403 [ 191, 9, 1] https://target.com/api/v1/user"
Core Flags
| Flag | Purpose |
|------|---------|
| -w FILE | Kite wordlist (.kite or .txt) |
| -x N | Concurrent requests |
| --ignore-length N | Filter by response length |
| -H "K:V" | Custom header |
| -A "bearer:TOKEN" | Auth header shorthand |
| --fail-status-codes | Codes treated as failures |
| --success-status-codes | Codes treated as hits |
| -o json | JSON output |
| --delay N | Per-request delay (ms) |
Common Workflows
Authenticated API scan:
kr scan https://api.target.com -w routes-large.kite -A "bearer:$TOKEN" -x 30
Filter noise — ignore typical 404/400 lengths:
kr scan https://api.target.com -w routes-small.kite --ignore-length 19
Replay to inspect full response:
kr replay -w routes-large.kite "POST 200 [ 512, 10, 2] https://api.target.com/api/v2/admin"
Resources
| File | When to load |
|------|--------------|
| references/ | Wordlist sources and API fingerprinting notes |
Related Skills
aeondave/unicorn
development
VerifiedTrustedCommunity
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
11SKILL.mdUpdated Jul 24, 2026
aeondave/renode
development
VerifiedTrustedCommunity
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qiling
development
VerifiedTrustedCommunity
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qemu
databases
VerifiedTrustedCommunity
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.
11SKILL.mdUpdated Jul 24, 2026