assetnote/kiterunner高速API和网站内容发现工具，使用编译好的Swagger数据集暴力破解路由，支持深度扫描、自定义字典和并发主机扫描。
长期以来，内容发现一直专注于查找文件和文件夹。虽然这种方法对于托管静态文件或在部分路径下返回 3xx 响应的传统 Web 服务器有效，但对于现代 Web 应用程序，尤其是 API，它已不再高效。
随着时间的推移，我们看到了大量时间投入到提高内容发现工具的速度上，以便可以使用更大的字典，但内容发现的艺术本身却没有得到创新。
Kiterunner 不仅能够以极快的速度执行传统内容发现，还能对现代应用程序中的路由/端点进行暴力破解。
现代应用框架（如 Flask、Rails、Express、Django 等）遵循显式定义路由的范式，这些路由期望特定的 HTTP 方法、头部、参数和值。
当使用传统的内容发现工具时，这些路由往往被遗漏，难以被发现。
Kiterunner 通过收集 Swagger 规范数据集并将其压缩为自身的模式，可以利用该数据集通过为每个发送的请求提供正确的 HTTP 方法、头部、路径、参数和值来暴力破解 API 端点。
Swagger 文件来自多个数据源，包括针对 40 多个最常见 Swagger 路径的互联网范围扫描。其他数据源包括 GitHub via BigQuery 和 APIs.guru。
你可以从 https://github.com/assetnote/kiterunner/releases 下载预编译的副本。
make build
ln -s $(pwd)/dist/kr /usr/local/bin/kr
kr kb compile routes.json routes.kite
kr scan hosts.txt -w routes.kite -x 20 -j 100 --ignore-length=1053
JSON数据集可在下方找到：
- [routes-large.json](https://wordlists-cdn.assetnote.io/rawdata/kiterunner/routes-large.json.tar.gz)（118MB压缩，2.6GB解压）
- [routes-small.json](https://wordlists-cdn.assetnote.io/rawdata/kiterunner/routes-small.json.tar.gz)（14MB压缩，228MB解压）
或者，也可以从以下链接下载编译好的 `.kite` 文件：
- [routes-large.kite](https://wordlists-cdn.assetnote.io/data/kiterunner/routes-large.kite.tar.gz)（40MB压缩，183MB解压）
- [routes-small.kite](https://wordlists-cdn.assetnote.io/data/kiterunner/routes-small.kite.tar.gz)（2MB压缩，35MB解压）
## AUR
使用基于Arch的发行版的用户可以从[AUR](https://aur.archlinux.org/packages/kiterunner-bin/)下载预构建的二进制文件。
你可以使用像 `yay` 这样的“AUR助手”来安装kiterunner。```
yay -S kiterunner-bin
kr [scan|brute] [flags]
- `<input>` 可以是文件、域名或 URI。我们会为您处理。查看 [Input/Host Formatting](#inputhost-formatting) 了解更多详情```
# Just have a list of hosts and no wordlist
kr scan hosts.txt -A=apiroutes-210328:20000 -x 5 -j 100 --fail-status-codes 400,401,404,403,501,502,426,411
# You have your own wordlist but you want assetnote wordlists too
kr scan target.com -w routes.kite -A=apiroutes-210328:20000 -x 20 -j 1 --fail-status-codes 400,401,404,403,501,502,426,411
# Bruteforce like normal but with the first 20000 words
kr brute https://target.com/subapp/ -A=aspx-210328:20000 -x 20 -j 1
# Use a dirsearch style wordlist with %EXT%
kr brute https://target.com/subapp/ -w dirsearch.txt -x 20 -j 1 -exml,asp,aspx,ashx -D
Usage: kite scan [flags]
Flags: -A, --assetnote-wordlist strings use the wordlists from wordlist.assetnote.io. specify the type/name to use, e.g. apiroutes-210228. You can specify an additional maxlength to use only the first N values in the wordlist, e.g. apiroutes-210228;20000 will only use the first 20000 lines in that wordlist --blacklist-domain strings domains that are blacklisted for redirects. We will not follow redirects to these domains --delay duration delay to place inbetween requests to a single host --disable-precheck whether to skip host discovery --fail-status-codes ints which status codes blacklist as fail. if this is set, this will override success-status-codes --filter-api strings only scan apis matching this ksuid --force-method string whether to ignore the methods specified in the ogl file and force this method -H, --header strings headers to add to requests (default [x-forwarded-for: 127.0.0.1]) -h, --help help for scan --ignore-length strings a range of content length bytes to ignore. you can have multiple. e.g. 100-105 or 1234 or 123,34-53. This is inclusive on both ends --kitebuilder-full-scan perform a full scan without first performing a phase scan. -w, --kitebuilder-list strings ogl wordlist to use for scanning -x, --max-connection-per-host int max connections to a single host (default 3) -j, --max-parallel-hosts int max number of concurrent hosts to scan at once (default 50) --max-redirects int maximum number of redirects to follow (default 3) -d, --preflight-depth int when performing preflight checks, what directory depth do we attempt to check. 0 means that only the docroot is checked (default 1) --profile-name string name for profile output file --progress a progress bar while scanning. by default enabled only on Stderr (default true) --quarantine-threshold int if the host return N consecutive hits, we quarantine the host as wildcard. Set to 0 to disable (default 10) --success-status-codes ints which status codes whitelist as success. this is the default mode -t, --timeout duration timeout to use on all requests (default 3s) --user-agent string user agent to use for requests (default "Chrome. Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36") --wildcard-detection can be set to false to disable wildcard redirect detection (default true)
Global Flags: --config string config file (default is $HOME/.kiterunner.yaml) -o, --output string output format. can be json,text,pretty (default "pretty") -q, --quiet quiet mode. will mute unecessarry pretty text -v, --verbose string level of logging verbosity. can be error,info,debug,trace (default "info")
暴力破解标志（以上所有标志 +）```
-D, --dirsearch-compat this will replace %EXT% with the extensions provided. backwards compat with dirsearch because shubs loves him some dirsearch
-e, --extensions strings extensions to append while scanning
-w, --wordlist strings normal wordlist to use for scanning
当提供输入时，kiterunner 将按以下顺序尝试解析输入：
如果你提供一个"域名"，但它作为一个文件存在，例如 google.com，但 google.com 在当前目录下也是一个 txt 文件，我们会加载 google.com 文本文件，因为我们首先找到了它。
域名解析
建议您提供完整的 URI 作为输入，但您也可以提供不完整的 URI，我们会尝试猜测您的意图。以下是一些您可以提供的域名示例列表：``` one.com two.com:80 three.com:443 four.com:9447 https://five.com:9090 http://six.com:80/api
上述域名列表将扩展为后续的目标列表```
(two targets are created for one.com, since neither port nor protocol was specified)
http://one.com (port 80 implied)
https://one.com (port 443 implied)
http://two.com (port 80 implied)
https://three.com (port 443 implied)
http://four.com:9447 (non-tls port guessed)
https://five.com:9090
http://six.com/api (port 80 implied; basepath API appended)
我们应用的规则如下：