API Recon with Kiterunner - Hacker Toolbox
Kiterunner is a brand new tool for API Recon which launched last week, and it's INCREDIBLE. I was so impressed when testing it out that I had to share it because this will be a game-changer for API recon, seriously. As in, this tool was able to find domain-specific API endpoints, where every tool has failed.
Did you know this episode was sponsored by Intigriti? Sign up with my link http://go.intigriti.com/katie I'm so pleased with everyone's positive response to the Intigriti sponsorship and I'm so pleased you folks are finding bugs and even finding your first bugs! Thank you for being awesome!
Links -
Kiterunner Introduction: https://blog.assetnote.io/2021/04/05/...
Assetnote Wordlists: https://wordlists.assetnote.io
Kiterunner GitHub: https://github.com/assetnote/kiterunner
Slides from BSides Canberra: https://drive.google.com/file/d/1PDc2...
Install Go: https://golang.org/doc/install
Install Brew: https://brew.sh
Commands -
Windows Instructions: go build -o dist/kr.exe ./cmd/kiterunner
Standard scan: kr scan http://127.0.0.1:8000/ -w ~/Downloads/routes-large.kite
Standard fuzzer: kr brute http://192.168.1.2:8000/ -A=apiroutes-210228
Multiple Targets: kr scan source.txt -w ~/Downloads/routes-large.kite
Repeat a request: kr kb replay -w ~/Downloads/routes-large.kite "GET 404 [ 7620, 1867, 167] http://127.0.0.1:8000/api/api/secure/acclandingpage/shoppers/60974302/orders/18350 0cf6832438c001b0aeeed5bc5a70f536908b08e7"
Add a filter: kr scan http://127.0.0.1:8000 -w ~/Downloads/routes-large.kite -A=apiroutes-210328:20000 --fail-status-codes 400,401,404,403,501,502,426,411
Plain text format: kr scan http://127.0.0.1:8000/api -w ~/Downloads/routes-large.kite -o text
Social Media -
Discord: https://insiderphd.dev/discord
Patreon: / insiderphd
Twitter: / insiderphd
Patreon Shoutouts -
David Kupratis
Bruna Simonian
Sean Doody
Forrest Held
Patreon
Wardell Castles
Gynvael
Ram
James Clee
00:00 - Introduction & Intigriti Sponsorship
02:00 - What makes Kiterunner special
10:55 - Installing Kiterunner
16:05 - Getting started, basic commands
22:33 - Adding extras
31:11 - Outro and Patreon shoutouts