kiterunner

Discover undocumented API endpoints by sending properly formatted requests with correct HTTP methods, headers, and parameters. This structured scanning approach matches API route structures to reduce false positive 404 responses and expose hidden API surface area.

Traditional content discovery tools return excessive false positive 404s because they send generic path requests without the correct HTTP methods, headers, or parameters required for API routes. API-aware wordlists prevent this by matching route structures.

You can use Swagger or OpenAPI specifications extracted from source maps during reconnaissance to generate targeted, accurate wordlists for API endpoint enumeration. These specifications provide the structured data needed for precise scanning.

The best way to find hidden admin endpoints in a microservices application is using API-specific wordlists that include HTTP methods, headers, and parameters. This structured approach validates endpoints accurately, saving time on manual false 404 checks.

Kiterunner works with REST APIs, GraphQL gateways, and microservices. It applies structured scans using API-specific wordlists to discover undocumented endpoints across these varied security testing scenarios.

You need API-specific wordlists where each entry includes HTTP method, headers, path, and parameters rather than just raw paths. These structured wordlists are required to match API route structures and reduce false positive results.