Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Working of "SCAN" command in kiterunner #45

Open
SecTheBit opened this issue Mar 10, 2022 · 0 comments
Open

Working of "SCAN" command in kiterunner #45

SecTheBit opened this issue Mar 10, 2022 · 0 comments

Comments

@SecTheBit
Copy link

Hi,
I have read that with "scan" command , kiterunner will send request with all the necessary headers, arguments, methods , etc. if the wordlist is in kite format. Refer below piece of code.
Screenshot from 2022-03-10 18-46-35

Now my questions are

  1. How does kiterunner will determine headers, arguments, methods,etc. if i simply give one of the assetnote wordlists which is not in the .kite format?
  2. It is also written as kiterunner will scan in 2 phase , when "scan" flag is given. Now , for example if some host is using "spring boot microservice" , will kiterunner scans only with the routes of "spring boot api" after getting hit from that particular api endpoint OR will it scan host with routes of other endpoint as well?
  3. Will that 2 phase Scanning work , if i provide wordlist which is not in the .kite format?
  4. How does kiterunner will do scanning if i use both .kite format wordlist and an assetnote wordlist. For ex:
kr scan https://www.target.com -w routes-large.kite -A=apiroutes-210628:2000
  1. If i want to reduce the "Total number of requests" generated by kiterunner for scanning , then i have to reduce the endpoints in the "routes-large.kite" , Right ? Or is there any other way also?

Thanks in advance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant