katana
Configurable web crawler that discovers endpoints and content in standard and headless modes to map attack surfaces and catalog applications.
Technical Architecture & Overview
katana is a web crawler and endpoint discovery framework from ProjectDiscovery. It can run in standard or headless mode and parses JavaScript, forms, and endpoints. Defenders use it to discover hidden paths and parameters and improve application inventory coverage.
Targeted Technical Use Cases
Discovery of web application and single-page application endpoints, parameters, and content for review.
Evaluation & Trade-offs
Core Strengths
- +Headless support for JavaScript-rendered single-page applications.
- +Configurable scope and output formats for automation pipelines.
- +Fast execution with pipeline integration alongside other ProjectDiscovery tools.
Trade-Offs & Limitations
- -Headless mode needs more resources and browser dependencies.
- -May trigger rate limits on protected targets.
- -Some modern SPAs require tuning for complete coverage.
Defensive Security Application
Build a complete inventory of exposed application paths and inputs to prioritize review and remediation.
Frequently Asked Questions
What is katana?→
katana is a web crawler and endpoint discovery framework from ProjectDiscovery. It can run in standard or headless mode and parses JavaScript, forms, and endpoints. Defenders use it to discover hidden paths and parameters and improve application inventory coverage.
What is katana used for?→
Discovery of web application and single-page application endpoints, parameters, and content for review.
What are the strengths of katana?→
- +Headless support for JavaScript-rendered single-page applications.
- +Configurable scope and output formats for automation pipelines.
- +Fast execution with pipeline integration alongside other ProjectDiscovery tools.
What are the limitations of katana?→
- +Headless mode needs more resources and browser dependencies.
- +May trigger rate limits on protected targets.
- +Some modern SPAs require tuning for complete coverage.
How is katana used defensively?→
Build a complete inventory of exposed application paths and inputs to prioritize review and remediation.