katana: crawling and endpoint discovery for web pentests

katana · MIT

katana crawls a web application and returns the URLs, endpoints and parameters it finds. Unlike the passive URL sources (gau, waybackurls), it sees the application as it exists right now, including routes that were never archived — and in headless mode, routes that only exist after JavaScript runs.

Install

go install -v github.com/projectdiscovery/katana/cmd/katana@latest

Headless mode needs a Chromium available; katana will download one on first use.

Core commands

# standard crawl
katana -u https://example.com -silent

# headless — required for SPAs
katana -u https://example.com -headless -silent

# depth, scope and JS parsing
katana -u https://example.com -d 3 -jc -kf all -silent

# keep it inside the engagement
katana -u https://example.com -crawl-scope example.com -silent

# JSONL with the request detail
katana -u https://example.com -jsonl -o crawl.jsonl -field url,method

-jc parses JavaScript files for endpoints. -kf all follows known files like robots.txt and sitemap.xml. -d is crawl depth — 3 is usually enough; 5 on a large app will run for a long time.

Output

{"timestamp":"2026-08-29T10:07:00Z","request":{"method":"GET",
 "endpoint":"https://example.com/api/v2/users?id=1"},
 "response":{"status_code":200}}

Where it sits in Tandera

katana appears in three flows and two phases — the only tool in the catalogue scheduled that broadly. It runs in fingerprint to establish the URL surface, and again in enrich to deepen it once other sources have contributed.

Its output is the input for several analyze steps: linkfinder and jxscout mine the JavaScript it retrieves, arjun fuzzes the parameters it found, and unfurl decomposes the URL corpus into hostnames, paths and parameter names.

Using it in a pentest

Use headless for anything modern. A React or Vue front end returns almost nothing to a non-headless crawler — the routes only exist after the bundle executes. If katana returns 12 URLs for an application you can see is large, that is the reason.

Scope the crawl explicitly. -crawl-scope prevents it from wandering onto a CDN, a payment provider or a third-party widget host. Crawling those is out of scope and, depending on the target, unlawful.

Crawl before you fuzz. The parameter names katana recovers are worth more than any generic wordlist, because they are the application’s own vocabulary.

katana -u https://example.com -headless -jc -d 3 -silent 
  | unfurl -u paths | sort -u > paths.txt