CmdID

CmdID / Commands

kiterunner-brute

A contextual web scanner for bruteforcing API paths and web endpoints using wordlists. tldr-pages

On several platforms

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

A contextual web scanner for bruteforcing API paths and web endpoints using wordlists. The brute subcommand targets one or multiple hosts.

Bruteforce a target with an Assetnote wordlist (e.g., first 20,000 API routes)

kiterunner brute https://example.com --assetnote-wordlist apiroutes-210328:20000Identify

Bruteforce a target with a custom wordlist

kiterunner brute https://example.com --wordlist path/to/wordlist.txtIdentify

Bruteforce using a dirsearch-style wordlist with extension substitution

kiterunner brute https://example.com --wordlist path/to/dirsearch.txt --dirsearch-compat --extensions json,txtIdentify

Bruteforce with specific file extensions appended and output in JSON format

kiterunner brute https://example.com --wordlist path/to/wordlist.txt --extensions aspx,ashx --output jsonIdentify

Bruteforce a list of targets from a file with custom concurrency settings for performance

kiterunner brute path/to/targets.txt --wordlist path/to/wordlist.txt --max-connection-per-host 5 --max-parallel-hosts 100Identify

Bruteforce and ignore specific content length responses

kiterunner brute https://example.com --wordlist path/to/wordlist.txt --ignore-length 100-105Identify

Bruteforce with custom HTTP headers

kiterunner brute https://example.com --wordlist path/to/wordlist.txt --header "Authorization: Bearer token"Identify

Bruteforce a list of targets from a file with fail status code filtering

kiterunner brute path/to/targets.txt --wordlist path/to/wordlist.txt --fail-status-codes 400,401,404Identify