Security tool · crawl

katana

Next-gen crawler with headless mode and JS parsing. Extracts URLs and endpoints for further testing.

crawlerurlsheadlessprojectdiscovery

Stable IDtool:katanaLast updated2026-08-20Last verifiedLegacy review pendingProvenanceSource-linked

Overview

Where katana fits

Next-gen crawler with headless mode and JS parsing. Extracts URLs and endpoints for further testing.

Detection-first use

Start with the least intrusive template that can distinguish your hypothesis from a normal response. Preserve raw output and a negative control.

Install

Installation references

Install with goAuthorization required

go install github.com/projectdiscovery/katana/cmd/katana@latest

Positive signal: Tool-specific output that supports the stated hypothesis.
Negative control: No result, or identical behavior against a known-safe control.
Intrusiveness: Review flags and target scope before execution.

Install with pdtmAuthorization required

pdtm -i katana

Positive signal: Tool-specific output that supports the stated hypothesis.
Negative control: No result, or identical behavior against a known-safe control.
Intrusiveness: Review flags and target scope before execution.

Test safely

Command templates

Crawl a hostAuthorization required

Populate placeholders only with assets that are explicitly in scope.

katana -u {url} -jc -o {output}

Positive signal: Tool-specific output that supports the stated hypothesis.
Negative control: No result, or identical behavior against a known-safe control.
Intrusiveness: Review flags and target scope before execution.

Headless deep crawlAuthorization required

Populate placeholders only with assets that are explicitly in scope.

katana -list {input} -headless -jc -d {depth} -o {output}

Positive signal: Tool-specific output that supports the stated hypothesis.
Negative control: No result, or identical behavior against a known-safe control.
Intrusiveness: Review flags and target scope before execution.

Continue the workflow

Sources

Attribution and verification

Version history: normalized permanent page created 2026-08-20. Upstream activity and popularity are separate signals and do not establish tool safety.