القائمة
[recon] Crawl a live web app to enumerate URLs, endpoints, JS-referenced paths, and forms. Reach for it to build the in-app URL/endpoint inventory that feeds param discovery, fuzzing, and DAST.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | katana |
| description | [recon] Crawl a live web app to enumerate URLs, endpoints, JS-referenced paths, and forms. Reach for it to build the in-app URL/endpoint inventory that feeds param discovery, fuzzing, and DAST. |
ProjectDiscovery's katana (Go, built CGO_ENABLED=1). Crawls a live target and
extracts URLs, parameters, and endpoints — including ones referenced from JS.
This image uses DOM/source crawling (headless browser mode is optional and heavier).
-u <url> / -list <file> seed targets.-d <n> crawl depth; -jc crawl JS files; -kf robotstxt,sitemapxml known files.-fs fqdn field-scope to the seed host (stay on-target); -crawl-scope/-crawl-out-scope regex.-rl <n> rate limit; -c <n> concurrency; -timeout <s>.-jsonl structured output; -f url,qurl output fields (e.g. only URLs with query params).-headless browser mode (heavier; needs chromium) — usually unnecessary here.# Depth-3 crawl incl. JS, scoped to the host, rate-limited, JSONL out
katana -u https://target.example.com -d 3 -jc -fs fqdn \
-rl 15 -c 10 -jsonl -o katana.jsonl
-fs fqdn (or scope regex) so links to
third-party domains are not followed and hit.-rl modest; honor per-host limits; stop on 429.