API Recon with Kiterunner - Hacker Toolbox 

Kiterunner is a brand new tool for API Recon which launched last week, and it's INCREDIBLE. I was so impressed when testing it out that I had to share it because this will be a game-changer for API recon, seriously. As in, this tool was able to find domain-specific API endpoints, where every tool has failed.
Did you know this episode was sponsored by Intigriti? Sign up with my link go.intigriti.com/katie I'm so pleased with everyone's positive response to the Intigriti sponsorship and I'm so pleased you folks are finding bugs and even finding your first bugs! Thank you for being awesome!
- Links -
- Kiterunner Introduction: blog.assetnote.io/2021/04/05/...
- Assetnote Wordlists: wordlists.assetnote.io
- Kiterunner GitHub: github.com/assetnote/kiterunner
- Slides from BSides Canberra: drive.google.com/file/d/1PDc2...
- Install Go: golang.org/doc/install
- Install Brew: brew.sh
- Commands -
- Windows Instructions: go build -o dist/kr.exe ./cmd/kiterunner
- Standard scan: kr scan 127.0.0.1:8000/ -w ~/Downloads/routes-large.kite
- Standard fuzzer: kr brute 192.168.1.2:8000/ -A=apiroutes-210228
- Multiple Targets: kr scan source.txt -w ~/Downloads/routes-large.kite
- Repeat a request: kr kb replay -w ~/Downloads/routes-large.kite "GET 404 [ 7620, 1867, 167] 127.0.0.1:8000/api/api/secure/acclandingpage/shoppers/60974302/orders/18350 0cf6832438c001b0aeeed5bc5a70f536908b08e7"
- Add a filter: kr scan 127.0.0.1:8000 -w ~/Downloads/routes-large.kite -A=apiroutes-210328:20000 --fail-status-codes 400,401,404,403,501,502,426,411
- Plain text format: kr scan 127.0.0.1:8000/api -w ~/Downloads/routes-large.kite -o text
- Social Media -
Discord: insiderphd.dev/discord
Patreon: / insiderphd
Twitter: / insiderphd
- Patreon Shoutouts -
David Kupratis
Bruna Simonian
Sean Doody
Forrest Held
Patreon
Wardell Castles
Gynvael
Ram
James Clee
00:00 - Introduction & Intigriti Sponsorship
02:00 - What makes Kiterunner special
10:55 - Installing Kiterunner
16:05 - Getting started, basic commands
22:33 - Adding extras
31:11 - Outro and Patreon shoutouts