katana

name	katana
description	Use katana for deep web crawling with full parameter discovery. Produces URLs with query strings, form targets, and JS endpoints that spray crawl strips.
internal	true

Katana — Parameter-Aware Web Crawler

Katana is a web crawler from ProjectDiscovery that preserves full URLs including query parameters, form actions, and JavaScript-discovered endpoints. Use it when you need to enumerate the attack surface of a web application beyond path discovery.

When to Use

• After scan or spray discovers web targets — katana fills in the parameter layer that spray crawl strips
• Before fuzzing — katana provides the target URLs with parameters to test
• When JavaScript-heavy applications need deeper endpoint extraction (-jc flag)
• When visible attack surface is thin — use katana as the batch candidate generator instead of manually extracting JS URLs one by one

Relationship to Spray Crawl

Spray crawl discovers paths and fingerprints. Katana discovers parameterized URLs. They complement each other:

• spray --crawl → paths, fingerprints, tech stack → feeds into neutron POC
• katana → full URLs with ?key=value, form targets, API endpoints → feeds into manual fuzzing

Do not feed every discovered URL back to the model one by one. Save or consume katana output as a batch, group by host/path/parameter shape, then select high-value candidates for authorization, unauthenticated access, upload, GraphQL, or injection validation.

Common Usage

katana -u https://target.com -d 3 -jc
katana -u https://target.com -d 2 -jsonl
katana -u https://target.com -f qurl
katana -u https://target.com -d 3 -jc -jsonl
katana -list urls.txt -d 2 -jc -timeout 60

Useful Filters

• -f qurl — only output URLs that contain query parameters
• -f kv — output key=value pairs extracted from URLs
• -f path — output only paths
• -em php,asp,jsp — match specific extensions
• -ef css,js,png,jpg,gif,svg,woff — filter out static assets

Output

Default output is one URL per line. Use -jsonl for structured JSON with request/response details. Agent should pick the format that fits the task — plain URLs for quick review, JSON for parameter extraction.