R-KAT
katana
Fast web crawler for discovering endpoints, JavaScript files, and forms across an application.
OVERVIEW
katana is a ProjectDiscovery crawler built for speed and depth: it walks an application following links, forms, and sitemap/robots.txt entries, and can optionally render pages with a headless browser to pick up endpoints only reachable through JavaScript execution — something a plain HTML-parsing crawler misses entirely on modern SPAs.
It supports scope rules, custom form-filling, and structured JSON output, which makes it a natural first step for building the endpoint inventory that later gets fed into parameter fuzzing (ffuf), vulnerability scanning (nuclei), or manual review in a proxy like Burp Suite.
USE CASES
Practical use cases
- 01
Building a full endpoint inventory of an application before manual or automated testing.
- 02
Crawling JavaScript-heavy SPAs with headless-browser mode to surface hidden routes.
- 03
Feeding discovered endpoints into ffuf, nuclei, or a Burp Suite scope.
- 04
Scoping a crawl to specific subdomains or path patterns on a large multi-app target.
QUICK START
When you need a fast, scriptable crawl of an application's endpoints (including JS-rendered links) to feed into further testing.
- Confirm the crawl's starting URL and depth are inside the agreed scope.
- Install katana via Go install or a precompiled release binary.
- Run a standard crawl first, then re-run with headless mode if the app is JS-heavy.
- Constrain scope with -field-scope or -crawl-scope so the crawl doesn't wander into out-of-scope domains.
- Export endpoints as JSON and hand them off to the next tool in the pipeline.
katana -u https://target.example.com -jc -d 3 -o endpoints.txtBEFORE YOU RUN IT
What to check before running it
Headless-browser crawling is much heavier than plain HTTP crawling — expect higher resource use and slower runs, and budget the testing window accordingly.
Without explicit scope rules, following links and forms can walk into out-of-scope subdomains or third-party assets — set -crawl-scope before a large run.
Auto-submitting discovered forms can trigger real side effects (password resets, emails, state changes) on a live app — review form-fill behavior before letting it run unattended.