Katana Web CrawlerStep-by-step reference: crawl lab apps deeply with Katana headless mode & JS parsing. Lab use only.FAQ

What is Katana?

Katana is a free, open-source web crawler in Go by ProjectDiscovery. It maps applications — links, forms, scripts, API endpoints — with standard and headless-Chrome modes plus JavaScript endpoint parsing.

Is using Katana legal?

Katana itself is legitimate open-source software. Crawling any site without explicit written permission is illegal and can overload fragile apps. Use it only on lab apps or authorized targets with sane depth and rate limits.

How do I install Katana?

Run go install github.com/projectdiscovery/katana/cmd/katana@latest. Headless mode additionally needs Chrome or Chromium installed. Verify with katana -version.

How do I crawl a lab app?

Run katana -u against your lab URL with -d 5 and -jc for JavaScript parsing, saving with -o endpoints.txt. Review the file for admin routes and API paths.

When do I need headless mode?

Single-page apps that render routes in JavaScript need -hl so Katana sees what a real browser sees. Add -xhr to log background API calls. It is slower, so use it after standard mode.

How does Katana feed other tools?

Its URL lists pipe straight into HTTPX, DalFox, and nuclei. Crawl once with Katana, then scan the inventory with each specialized tool.

Why is my crawl empty?

Increase depth, enable -jc, and try -hl for JS apps. Check the target is reachable and authentication cookies are passed if the app needs login.

How do I stay in scope?

Crawl only authorized hosts, exclude logout and destructive routes, cap depth and rate, and stop immediately if you leave the agreed scope.

All tools · Sitemap · Games