Hack EVERY API! KiteRunner - Hacker Tools

Подписаться 26 тыс.

Просмотров 26 тыс.

50% 1

👨‍💻🛠️ In this week's episode of Hacker Tools, we will take a look at KiteRunner.
00:00 Introduction
00:15 Why do we need API enumeration?
00:40 What is KiteRunner?
01:40 Running KiteRunner
03:00 Checking out KiteRunner wordlists and bruteforces
06:15 Checking the results
07:00 Outro
---
📰 Check out the accompanying blog post here: blog.intigriti.com/2021/09/07...
🧑‍💻 Sign up and start hacking right now - go.intigriti.com/register
👾 Join our Discord - go.intigriti.com/discord
🎙️ This show is hosted by / pinkdraconian & / intigriti
👕 Do you want some Intigriti Swag? Check out swag.intigriti.com/

Опубликовано:

5 авг 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 30

@redteamgarage299 9 месяцев назад

Very informative ❤

@intigriti 9 месяцев назад

Glad it was helpful!

@droidhackerr 2 года назад

wow ... thanks for this.

@intigriti 2 года назад

Glad you enjoyed it!

@seiv- 2 года назад

What’s the difference of this one with gobuster for example ? What extra does this bring ?

@intigriti 2 года назад

We actually had someone ask this in our Discord as well. So feel free to check that out. Gobuster just bruteforces directories whereas KiteRunner uses the context it's in more.

@fahadfaisal2383 2 года назад

Good!

@intigriti 2 года назад

Thanks!

@basitkhan3853 2 года назад

Sir I found a endpoint name"admin.sign up" but when I visit this endpoint in a browser I found a empty page in which there are only 2 HTML tag and whole page is empty can you give me some idea how I move on forward

@user-uj2km6zr7s 2 года назад

Lol

@intigriti 2 года назад

This is highly dependent on implementation so without further contextual information, there isn't much I can do I'm afraid ;)

@juanjoivars3254 Год назад

Whats the difference between scan and brute?

@intigriti Год назад

# Use a dirsearch style wordlist with %EXT% kr brute target.com/subapp/ -w dirsearch.txt -x 20 -j 1 -exml,asp,aspx,ashx -D # You have your own wordlist but you want assetnote wordlists too kr scan target.com -w routes.kite -A=apiroutes-210328:20000 -x 20 -j 1 --fail-status-codes 400,401,404,403,501,502,426,411