katana
Configurable web crawler that discovers endpoints and content in standard and headless modes to map attack surfaces and catalog applications.
Technical Architecture & Overview
katana is a web crawler and endpoint discovery framework from ProjectDiscovery. It can run in standard or headless mode and parses JavaScript, forms, and endpoints. Defenders use it to discover hidden paths and parameters and improve application inventory coverage.
Targeted Technical Use Cases
Discovery of web application and single-page application endpoints, parameters, and content for review.
Evaluation & Trade-offs
Core Strengths
- +Headless support for JavaScript-rendered single-page applications.
- +Configurable scope and output formats for automation pipelines.
- +Built for automation pipelines and accepts piped input from other ProjectDiscovery tools such as httpx.
Trade-Offs & Limitations
- -Headless mode depends on a Chrome browser and is marked experimental.
- -Automatic form filling is marked experimental.
Defensive Security Application
Build an inventory of exposed application paths and inputs to prioritize review and remediation.
Frequently Asked Questions
What is katana?→
katana is a web crawler and endpoint discovery framework from ProjectDiscovery. It can run in standard or headless mode and parses JavaScript, forms, and endpoints. Defenders use it to discover hidden paths and parameters and improve application inventory coverage.
What is katana used for?→
Discovery of web application and single-page application endpoints, parameters, and content for review.
What are the strengths of katana?→
- +Headless support for JavaScript-rendered single-page applications.
- +Configurable scope and output formats for automation pipelines.
- +Built for automation pipelines and accepts piped input from other ProjectDiscovery tools such as httpx.
What are the limitations of katana?→
- +Headless mode depends on a Chrome browser and is marked experimental.
- +Automatic form filling is marked experimental.
How is katana used defensively?→
Build an inventory of exposed application paths and inputs to prioritize review and remediation.