Skip to content
Deepak Gupta markRecon Atlas

URL and endpoint discovery

Katana

Web crawler that maps URLs and endpoints on a target site, with an optional headless browser mode for JavaScript-heavy apps.

ActiveScope a pentestAudit your own exposure

18k stars · last push November 9, 2026 · v1.8.0 · MIT

GitHub repositoryOfficial docs

What it finds

Katana crawls the target domain's own pages and follows links, forms and (with -jc) endpoints found in JavaScript files. Standard mode parses raw HTTP responses; headless mode renders pages in Chrome for better coverage of client-side routes. Optional flags add robots.txt and sitemap.xml crawling, form filling, scope rules and page classification.

  • URLs
  • endpoints
  • JavaScript files
  • forms
  • XHR requests
  • secrets in responses (optional)

Does it touch the target?

Sends traffic to the target's systems. Use only with the owner's permission.

It sends requests to the target's own hosts. README: "Standard crawling modality uses the standard go http library under the hood to handle HTTP requests/responses." Headless mode (-headless) drives Chrome against the target. README also warns that -kb-validate-secrets "sends live API calls" to the secret's provider.

API keys: Crawling needs no key; the README lists optional keys only for add-ons: a captcha solver (-csk, env CAPTCHA_SOLVER_KEY) and an AI provider for crawl decisions (-ai-key, env AI_API_KEY).

Install

Install with go
CGO_ENABLED=1 go install github.com/projectdiscovery/katana/cmd/katana@latest

From the project's documentation

Install with docker
docker pull projectdiscovery/katana:latest

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Crawl a single URL
katana -u https://example.com

From the project's documentation

Parse JavaScript files and crawl endpoints found in them
katana -u https://example.com -jc

From the project's documentation

Also crawl robots.txt and sitemap.xml
katana -u https://example.com -kf robotstxt,sitemapxml

From the project's documentation

Headless crawl without the Chrome sandbox (when running as root)
katana -u https://example.com -headless -no-sandbox

From the project's documentation

Output formats: stdout, file, JSONL

Limits the project documents

  • Standard mode analyses responses without JavaScript or DOM rendering, "potentially missing post-dom-rendered endpoints or asynchronous endpoint calls".
  • Headless hybrid crawling is labelled experimental in the flag help.
  • -known-files needs a minimum crawl depth of 3 to crawl all known files properly.
  • Interactive exploration selectors "cannot reach every canvas control, closed shadow root, or cross origin frame".
  • Requires Go 1.26.10+ to install from source; CGO_ENABLED=1 in the documented go install command.

Deepak's take

Analysis, not documentation

Use it when
Reach for it when you need a live map of what a site you are authorised to test exposes today, including client-rendered routes via headless mode.
Skip it when
Skip it when you must not send traffic to the target domain. Use a passive archive tool such as gau, waybackurls or URLFinder instead.
What it will miss
It only finds what is linked or reachable from the start URL in scope, so retired or unlinked endpoints stay invisible.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: MIT. Katana is a trademark or project name of its owners; this library is not affiliated with it.