search

assetnote / kiterunner

Contextual Content Discovery Tool
GNU Affero General Public License v3.0
2.57k stars 285 forks source link

Working of "SCAN" command in kiterunner #45

Open SecTheBit opened 2 years ago

SecTheBit commented 2 years ago

Hi, I have read that with "scan" command , kiterunner will send request with all the necessary headers, arguments, methods , etc. if the wordlist is in kite format. Refer below piece of code. Screenshot from 2022-03-10 18-46-35

Now my questions are

  1. How does kiterunner will determine headers, arguments, methods,etc. if i simply give one of the assetnote wordlists which is not in the .kite format?
  2. It is also written as kiterunner will scan in 2 phase , when "scan" flag is given. Now , for example if some host is using "spring boot microservice" , will kiterunner scans only with the routes of "spring boot api" after getting hit from that particular api endpoint OR will it scan host with routes of other endpoint as well?
  3. Will that 2 phase Scanning work , if i provide wordlist which is not in the .kite format?
  4. How does kiterunner will do scanning if i use both .kite format wordlist and an assetnote wordlist. For ex: 
    kr scan https://www.target.com -w routes-large.kite -A=apiroutes-210628:2000
  5. If i want to reduce the "Total number of requests" generated by kiterunner for scanning , then i have to reduce the endpoints in the "routes-large.kite" , Right ? Or is there any other way also?

Thanks in advance.