assetnote/kiterunner

Health v2 · maintenance only

Adoption not part of the score

3247 stars · 342 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Kiterunner is a fast content discovery tool written in Go that bruteforces files, folders, and API routes on web servers. It uses a dataset of Swagger/OpenAPI specifications to send correctly-formed requests (HTTP methods, headers, parameters) to discover endpoints in modern application frameworks that traditional directory brute-forcers miss.

Use cases

• discover hidden API endpoints on a target web application
• bruteforce routes in Flask, Rails, Express, or Django apps with correct HTTP methods
• perform fast traditional directory and file content discovery
• scan targets using Swagger-derived wordlists
• convert Swagger files and dirsearch outputs into kite format for scanning
• replay discovered requests for verification

When to choose

• you need API endpoint discovery beyond simple file/folder bruteforcing
• you want very high-speed content discovery with configurable concurrency
• you have Swagger/OpenAPI-based wordlists to target modern frameworks

When to avoid

• you need a GUI-based vulnerability scanner rather than a CLI discovery tool
• your targets are not web applications or APIs
• you require a maintained commercial product with support

Facets

cli-tool · maturity stable

security http-client web-scraping security penetration-testing apis web-development windows cli go content-discovery api-endpoint-bruteforcing swagger dirsearch wordlists bug-bounty linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="assetnote/kiterunner")