Hack EVERY API! KiteRunner - Hacker Tools

[@redteamgarage299]

Very informative ❤

[@intigriti]

Glad it was helpful!

[@seiv-]

What’s the difference of this one with gobuster for example ? What extra does this bring ?

[@intigriti]

We actually had someone ask this in our Discord as well. So feel free to check that out. Gobuster just bruteforces directories whereas KiteRunner uses the context it's in more.

[@basitkhan3853]

Sir I found a endpoint name"admin.sign up" but when I visit this endpoint in a browser I found a empty page in which there are only 2 HTML tag and whole page is empty can you give me some idea how I move on forward

[@NinjaFTD]

Lol

[@intigriti]

This is highly dependent on implementation so without further contextual information, there isn't much I can do I'm afraid ;)

[@crusader_]

Could you cover a waf detection tool

[@intigriti]

Do you have any examples of tools for that?

[@crusader_]

Wafwoof. But I'm not sure if it's the best one out there.

[@InsaneRecords997]

@@crusader_ bro wafw00f is used to detect waf technology behind web app

[@juanjoivars3254]

Whats the difference between scan and brute?

[@intigriti]

# Use a dirsearch style wordlist with %EXT% kr brute target.com/subapp/ -w dirsearch.txt -x 20 -j 1 -exml,asp,aspx,ashx -D # You have your own wordlist but you want assetnote wordlists too kr scan target.com -w routes.kite -A=apiroutes-210328:20000 -x 20 -j 1 --fail-status-codes 400,401,404,403,501,502,426,411

[@droidhackerr]

wow ... thanks for this.

[@intigriti]

Glad you enjoyed it!

[@tired409]

the one simple scan is taking me just over 4hrs to complete am i doing something wrong?

[@intigriti]

It could be that the website is very slow, the wordlist large and perhaps your internet a bit slower as well.

[@fahadfaisal2383]

Good!

[@intigriti]

Thanks!

[@deepaksaini3257]

How to download wordlist

[@intigriti]

KiteRunner will do that for you!

[@tcib5055]

'kr' is not recognized as an internal or external command

[@intigriti]

Make sure the binary is in your PATH.

[@yuhiahtyun5665]

noice

[@intigriti]

Thanks!

[@tcib5055]

" " or " " get error The filename, directory name, or volume label syntax is incorrect but type localhost:8080 to pass

[@intigriti]

Nice!

[@InsaneRecords997]

@@intigriti 😂