Authorized AI penetration testing assistant for web applications, APIs, and infrastructure. Performs reconnaissance, vulnerability assessment, PoC validation, exploit chaining, and professional reporting. Use when the user asks for pentest, penetration test, security assessment, vulnerability scan, bug bounty research, authorized hacking, SQLi/XSS/IDOR/SSRF testing, API security audit, or exploit validation.

2026-07-062

penkit51-ai

xAmirHamza77/PenKit51

Authorized AI penetration testing for web apps, APIs, cloud, and infrastructure. Full kill-chain methodology with PoC validation, vulnerability chaining, and professional reporting. Triggers on: pentest, penetration test, security assessment, vuln scan, bug bounty, red team, authorized hack, SQL injection test, XSS test, IDOR, SSRF, API security, exploit validation, security audit.

2026-07-062

penkit51-ai

xAmirHamza77/PenKit51

Authorized AI penetration testing assistant — full-spectrum security testing with deep exploitation skills and integrated tooling. Use for web app pentests, API security, vuln validation, PoC development, bug bounty, and security assessments. Triggers on pentest, penetration test, security audit, exploit, SQLi, XSS, IDOR, SSRF.

2026-07-062

api-security-testing

xAmirHamza77/PenKit51

API安全测试的专业技能和方法论

2026-07-062

authentication-jwt-testing

xAmirHamza77/PenKit51

JWT and OIDC security testing covering token forgery, algorithm confusion, and claim manipulation

2026-07-062

aws-security-audit

xAmirHamza77/PenKit51

AWS cloud security testing covering IAM misconfigurations, S3 exposure, metadata abuse, and privilege escalation paths

2026-07-062

name	katana-tooling
description	Katana crawler syntax, depth/js/known-files behavior, and stable concurrency controls.

Katana Tooling

penkit51 AI — professional penetration testing skill pack. Authorized testing only.

Deep Exploitation Guide

Katana CLI Playbook

Official docs:

Canonical syntax: katana [flags]

High-signal flags:

-u, -list <url|file> target URL(s)
-d, -depth <n> crawl depth
-jc, -js-crawl parse JavaScript-discovered endpoints
-jsl, -jsluice deeper JS parsing (memory intensive)
-kf, -known-files <all|robotstxt|sitemapxml> known-file crawling mode
-proxy <http|socks5 proxy> explicit proxy setting
-c, -concurrency <n> concurrent fetchers
-p, -parallelism <n> concurrent input targets
-rl, -rate-limit <n> request rate limit
-timeout <seconds> request timeout
-retry <n> retry count
-ef, -extension-filter <list> extension exclusions
-tlsi, -tls-impersonate experimental JA3/TLS impersonation
-hl, -headless enable hybrid headless crawling
-sc, -system-chrome use local Chrome for headless mode
-ho, -headless-options <csv> extra Chrome options (for example proxy-server)
-nos, -no-sandbox run Chrome headless with no-sandbox
-noi, -no-incognito disable incognito in headless mode
-cdd, -chrome-data-dir <dir> persist browser profile/session
-xhr, -xhr-extraction include XHR endpoints in JSONL output
-silent, -j, -jsonl, -o <file> output controls

Agent-safe baseline for automation: mkdir -p crawl && katana -u https://target.tld -d 3 -jc -kf robotstxt -c 10 -p 10 -rl 50 -timeout 10 -retry 1 -ef png,jpg,jpeg,gif,svg,css,woff,woff2,ttf,eot,map -silent -j -o crawl/katana.jsonl

Common patterns:

Fast crawl baseline: katana -u https://target.tld -d 3 -jc -silent
Deeper JS-aware crawl: katana -u https://target.tld -d 5 -jc -jsl -kf all -c 10 -p 10 -rl 50 -o katana_urls.txt
Multi-target run with JSONL output: katana -list urls.txt -d 3 -jc -silent -j -o katana.jsonl
Headless crawl with local Chrome: katana -u https://target.tld -hl -sc -nos -xhr -j -o crawl/katana_headless.jsonl
Headless crawl through proxy: katana -u https://target.tld -hl -sc -ho proxy-server=http://127.0.0.1:48080 -j -o crawl/katana_proxy.jsonl

Critical correctness rules:

-kf must be followed by one of all, robotstxt, or sitemapxml.
Use documented -hl for headless mode.
-proxy expects a single proxy URL string (for example http://127.0.0.1:8080).
-ho expects comma-separated Chrome options (example: -ho --disable-gpu,proxy-server=http://127.0.0.1:8080).
For -kf, keep depth at least -d 3 so known files are fully covered.
If writing to a file, ensure parent directory exists before -o.

Usage rules:

Keep -d, -c, -p, and -rl explicit for reproducible runs.
Use -ef early to reduce static-file noise before fuzzing.
Prefer -proxy over environment proxy variables when proxying only Katana traffic.
Use -hc only for one-time diagnostics, not routine crawling loops.
Do not use -h/--help for routine runs unless absolutely necessary.

Failure recovery:

If crawl runs too long, lower -d and optionally add -ct.
If memory spikes, disable -jsl and lower -c/-p.
If headless fails with Chrome errors, drop -sc or install system Chrome.
If output is noisy, tighten scope and add -ef filters.

If uncertain, query web_search with: site:docs.projectdiscovery.io katana <flag> usage

Complementary crawlers / JS endpoint extractors in the sandbox:

gospider -s https://target.tld -d 3 -c 10 -t 20 — alternate crawler; picks up things Katana misses on weird sites; use it as a second pass when Katana output looks thin.
~/tools/JS-Snooper/js_snooper.sh <domain> and ~/tools/jsniper.sh/jsniper.sh <domain> — both take a bare domain and run their own JS-file discovery internally (jsniper drives httpx + katana + nuclei file templates). Reach for them when you want a quick "find endpoints/keys/secrets in any JS this domain serves" sweep without wiring it up yourself.

Platform Methodology

Katana Tooling

penkit51 AI — professional penetration testing skill pack. Authorized testing only.

Deep Exploitation Guide

Katana CLI Playbook

Official docs:

Canonical syntax: katana [flags]

High-signal flags:

-u, -list <url|file> target URL(s)
-d, -depth <n> crawl depth
-jc, -js-crawl parse JavaScript-discovered endpoints
-jsl, -jsluice deeper JS parsing (memory intensive)
-kf, -known-files <all|robotstxt|sitemapxml> known-file crawling mode
-proxy <http|socks5 proxy> explicit proxy setting
-c, -concurrency <n> concurrent fetchers
-p, -parallelism <n> concurrent input targets
-rl, -rate-limit <n> request rate limit
-timeout <seconds> request timeout
-retry <n> retry count
-ef, -extension-filter <list> extension exclusions
-tlsi, -tls-impersonate experimental JA3/TLS impersonation
-hl, -headless enable hybrid headless crawling
-sc, -system-chrome use local Chrome for headless mode
-ho, -headless-options <csv> extra Chrome options (for example proxy-server)
-nos, -no-sandbox run Chrome headless with no-sandbox
-noi, -no-incognito disable incognito in headless mode
-cdd, -chrome-data-dir <dir> persist browser profile/session
-xhr, -xhr-extraction include XHR endpoints in JSONL output
-silent, -j, -jsonl, -o <file> output controls

Common patterns:

Fast crawl baseline: katana -u https://target.tld -d 3 -jc -silent
Deeper JS-aware crawl: katana -u https://target.tld -d 5 -jc -jsl -kf all -c 10 -p 10 -rl 50 -o katana_urls.txt
Multi-target run with JSONL output: katana -list urls.txt -d 3 -jc -silent -j -o katana.jsonl
Headless crawl with local Chrome: katana -u https://target.tld -hl -sc -nos -xhr -j -o crawl/katana_headless.jsonl
Headless crawl through proxy: katana -u https://target.tld -hl -sc -ho proxy-server=http://127.0.0.1:48080 -j -o crawl/katana_proxy.jsonl

Critical correctness rules:

-kf must be followed by one of all, robotstxt, or sitemapxml.
Use documented -hl for headless mode.
-proxy expects a single proxy URL string (for example http://127.0.0.1:8080).
-ho expects comma-separated Chrome options (example: -ho --disable-gpu,proxy-server=http://127.0.0.1:8080).
For -kf, keep depth at least -d 3 so known files are fully covered.
If writing to a file, ensure parent directory exists before -o.

Usage rules:

Keep -d, -c, -p, and -rl explicit for reproducible runs.
Use -ef early to reduce static-file noise before fuzzing.
Prefer -proxy over environment proxy variables when proxying only Katana traffic.
Use -hc only for one-time diagnostics, not routine crawling loops.
Do not use -h/--help for routine runs unless absolutely necessary.

Failure recovery:

If crawl runs too long, lower -d and optionally add -ct.
If memory spikes, disable -jsl and lower -c/-p.
If headless fails with Chrome errors, drop -sc or install system Chrome.
If output is noisy, tighten scope and add -ef filters.

If uncertain, query web_search with: site:docs.projectdiscovery.io katana <flag> usage

Complementary crawlers / JS endpoint extractors in the sandbox:

gospider -s https://target.tld -d 3 -c 10 -t 20 — alternate crawler; picks up things Katana misses on weird sites; use it as a second pass when Katana output looks thin.
~/tools/JS-Snooper/js_snooper.sh <domain> and ~/tools/jsniper.sh/jsniper.sh <domain> — both take a bare domain and run their own JS-file discovery internally (jsniper drives httpx + katana + nuclei file templates). Reach for them when you want a quick "find endpoints/keys/secrets in any JS this domain serves" sweep without wiring it up yourself.

Validation & Reporting

Confirm every finding with reproducible PoC before reporting
Document: severity (CVSS), affected asset, steps, evidence, remediation
Use record_vulnerability when running inside the penkit51 platform
Chain low-severity findings into higher-impact attack paths
Never report without evidence — distinguish hypothesis from confirmed vuln

Validation & Reporting

Confirm every finding with reproducible PoC before reporting
Document: severity (CVSS), affected asset, steps, evidence, remediation
Use record_vulnerability when running inside the penkit51 platform
Chain low-severity findings into higher-impact attack paths
Never report without evidence — distinguish hypothesis from confirmed vuln