# katana: crawling and endpoint discovery for web pentests

> How to install and run katana, when to use headless mode, and how Tandera uses its crawl output to feed parameter and secret analysis.

`katana` crawls a web application and returns the URLs, endpoints and parameters it finds. Unlike the passive URL sources (`gau`, `waybackurls`), it sees the application as it exists right now, including routes that were never archived — and in headless mode, routes that only exist after JavaScript runs.

## Install

```bash
go install -v github.com/projectdiscovery/katana/cmd/katana@latest
```

Headless mode needs a Chromium available; katana will download one on first use.

## Core commands

```bash
# standard crawl
katana -u https://example.com -silent

# headless — required for SPAs
katana -u https://example.com -headless -silent

# depth, scope and JS parsing
katana -u https://example.com -d 3 -jc -kf all -silent

# keep it inside the engagement
katana -u https://example.com -crawl-scope example.com -silent

# JSONL with the request detail
katana -u https://example.com -jsonl -o crawl.jsonl -field url,method
```

`-jc` parses JavaScript files for endpoints. `-kf all` follows known files like `robots.txt` and `sitemap.xml`. `-d` is crawl depth — 3 is usually enough; 5 on a large app will run for a long time.

## Output

```json
{"timestamp":"2026-08-29T10:07:00Z","request":{"method":"GET",
 "endpoint":"https://example.com/api/v2/users?id=1"},
 "response":{"status_code":200}}
```

## Where it sits in Tandera

katana appears in three flows and two phases — the only tool in the catalogue scheduled that broadly. It runs in **fingerprint** to establish the URL surface, and again in **enrich** to deepen it once other sources have contributed.

Its output is the input for several **analyze** steps: `linkfinder` and `jxscout` mine the JavaScript it retrieves, `arjun` fuzzes the parameters it found, and `unfurl` decomposes the URL corpus into hostnames, paths and parameter names.

## Using it in a pentest

**Use headless for anything modern.** A React or Vue front end returns almost nothing to a non-headless crawler — the routes only exist after the bundle executes. If katana returns 12 URLs for an application you can see is large, that is the reason.

**Scope the crawl explicitly.** `-crawl-scope` prevents it from wandering onto a CDN, a payment provider or a third-party widget host. Crawling those is out of scope and, depending on the target, unlawful.

**Crawl before you fuzz.** The parameter names katana recovers are worth more than any generic wordlist, because they are the application's own vocabulary.

```bash
katana -u https://example.com -headless -jc -d 3 -silent \
  | unfurl -u paths | sort -u > paths.txt
```

---

Canonical: https://tandera.io/tools/katana
This page as markdown: https://tandera.io/tools/katana.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.