kiterunner

Discover hidden API endpoints by performing context-aware route enumeration against REST and gRPC services. This approach automates the discovery of unlinked routes, uncovering potential vulnerabilities often missed by traditional directory brute-forcing.

Yes, you can brute-force gRPC services to find unlinked routes. The tool efficiently probes gRPC and REST services by leveraging specialized wordlists derived from real-world API schemas for precise endpoint enumeration.

Yes, API route discovery works on Linux, macOS, and Windows. The tool is distributed as a Go binary, requiring specific wordlist files for operation to ensure cross-platform compatibility during web security assessments.

Yes, you need specific wordlist files for API endpoint enumeration. The process leverages real-world API schema wordlists to efficiently probe for hidden routes, and you can start scanning a target URL with the default small wordlist.

The best way to enumerate hidden routes on REST APIs is using context-aware discovery tools. Unlike traditional directory brute-forcing, this method uses real-world API schema wordlists to efficiently uncover all possible unlinked endpoints.

Use context-aware API route discovery instead of directory brute-forcing because traditional tools often miss hidden API endpoints. This method leverages real-world API schemas to accurately target and automate the enumeration of unlinked REST and gRPC routes.