Katana CLI
Katana is a CLI crawler that saves form and request details as JSONL so crawl results can be processed by other tools.
- 17,803 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Crawling sends many requests and can retain authenticated page content in results.
Install
Manual install
CGO_ENABLED=1 go install github.com/projectdiscovery/katana/cmd/katana@latestFirst Installation command. Verify the README Go version and CGO requirements.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Crawling sends many requests and can retain authenticated page content in results.
This is third-party code. Review the repository files before installing.
What it does
Katana collects URLs and web-application elements while crawling a site. Bound scope, depth and request rates, parse JavaScript and save results for subsequent tools. Filters retain relevant addresses and exclude unwanted paths. Browser-assisted crawling handles pages requiring JavaScript. JSONL can include form and network-request information. It is an inventory and discovery tool for authorized resources; discovered URLs need separate investigation and are not vulnerabilities by themselves.
Who it is for. Web security engineers mapping authorized sites with explicit crawl and load limits.
Good fit when
- An analyst collects reachable URLs before reviewing a site.
- A JavaScript application needs route and form discovery.
- A client has authorized only part of the domains and paths.
- The application map is passed to another tool as JSONL.
Not a fit when
- The resource owner has not authorized crawling.
- The production site cannot tolerate the chosen request rate.
- Discovered URLs would be presented as a vulnerability report.
Example request
Prepare a low-rate crawl of my staging domain without following other domains or retaining response bodies.Limitations
The first installation method needs a compatible Go toolchain with CGO enabled; verify the exact minimum in the current README. Browser mode is experimental and needs a compatible browser, so test it separately on a small page set. Set scope and rate limits before running to avoid unwanted load or traversal beyond agreed paths. JSONL can include response bodies and internal details, so restrict output fields before sharing results.
How to disable. Stop the crawl and review saved output files. Remove supplied authentication data from temporary configuration.
FAQ
Can I limit request rates?
Set `-rate-limit` to the maximum requests per second. `-host-rate-limit` applies a separate per-host ceiling. Choose values within the agreed load.
Does it handle JavaScript?
Use `-js-crawl` to discover endpoints in JavaScript files. For pages that need script execution, use experimental `-headless` with a configured browser. Test it on a small page set first.
Can I restrict paths?
Pass regular expressions to `-crawl-scope` for allowed URLs and `-crawl-out-scope` for exclusions. Compare the first discovered addresses with the agreed scope.
Is JSONL available?
Enable `-jsonl`. Use `-omit-body` to omit response bodies and `-omit-raw` to omit raw requests and responses. Select the information the recipient needs before sharing.
Does it confirm vulnerabilities?
No. It discovers application surfaces for subsequent security testing.
Discussion
No questions or reviews yet.
Related
CLI toolshttpx is a ProjectDiscovery CLI that reports on a list of web endpoints using selected fields and a configured request rate.
BBOT is an external-infrastructure CLI scanner whose findings feed tables or graphs through JSON, CSV and Neo4j output.
uncover is a network-asset search CLI that queries external indexes; discovered hosts still need separate availability checks.
An agentic web scanner: terminal workspace, six stages from recon to report, browser validation of findings, REST and MCP
A skill for taking apart web clients with signatures, tokens and bot protection: the result is a browser-free Python collector
Devil's Eye: OSINT with a Russian layer
glaz-dyavola
An OSINT tool for passive reconnaissance: EGRUL, FSSP, VK, Telegram and Yandex alongside secret scanning and a 15-tool MCP server
README in short
Per-host request limits and output-field selection are available. Container execution and browser setup have separate options.