katana: Crawl a Web App for Every Endpoint (GitHub, Scanned)

katana crawls a website and lists every URL, endpoint and parameter it can reach. Standard mode is a fast HTTP crawler that parses HTML and, with -js-crawl, JavaScript files for paths. Headless mode drives Chrome, so it also sees links that only appear after the page's scripts run, along with the XHR and fetch calls a single-page app makes. Scope rules keep it on the domain you name, filters drop duplicate-looking pages, and output can be plain URLs or JSON with forms, technologies and request details for each hit.

It is the last step of ProjectDiscovery's recon chain: subfinder finds the names, httpx keeps the live websites, and katana maps what is inside each one. That endpoint list is what you then review or test. Newer opt-in features go further: a page classifier that labels login, error and parked pages, a secrets extractor, an OpenAI-compatible model hook to guide crawl decisions, and automatic form filling.

katana is MIT-licensed and the most starred of ProjectDiscovery's recon tools here, with about 17,800 stars, 75 contributors and 23 releases. The last push was on 28 October 2026 and v1.8.0 shipped on 5 October.

• Repository: github.com/projectdiscovery/katana
• Licence: MIT (MIT License)
• Language: Go. Stars: 17.8K. Forks: 1,210. Last push: Oct 28, 2026.
• Scan: safe, Oct 28, 2026, commit e1a9ba7

Who it is for

Application security teams mapping their own web apps before a test, bug bounty hunters looking for endpoints inside an in-scope site, and developers who want a crawl of their staging site to spot forgotten pages.

Getting started

1. Install with Go (needs Go 1.26.10 or later and CGO; release binaries are also published)

CGO_ENABLED=1 go install github.com/projectdiscovery/katana/cmd/katana@latest

2. Crawl a site you are authorised to test, three levels deep, parsing JavaScript too

katana -u https://example.com -d 3 -jc

3. Or use the Docker image in headless mode

docker run projectdiscovery/katana:latest -u https://example.com -system-chrome -headless

A crawl sends many requests and, with form filling or headless mode, can submit forms and trigger actions on the site: run it only against sites you own or have permission to test, and set -rate-limit. Headless mode downloads a Chromium build unless you pass -system-chrome. Add -duc to skip the update check.

Safety scan

We cloned projectdiscovery/katana at commit e1a9ba7 on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no pattern hits and no committed binaries across 234 files and about 52,000 lines, mostly Go plus JSON test data. Most hosts in the scan are test targets: security-crawl-maze.app and public-firing-range.appspot.com are Google's crawler test sites, the rest are example domains. The two run.sh scripts are CI test helpers.
• Two opt-in flags deserve care. -kb-validate-secrets checks any API keys katana finds on a page by calling their provider, which on a site you do not own means using someone else's credentials. -captcha-solver-provider sends reCAPTCHA, hCaptcha and Turnstile challenges to the paid CapSolver service; getting past a site's bot checks can breach its terms.
• The page classifier downloads its model from Hugging Face to ~/.dit/model.json the first time you pass -kb. Like subfinder and httpx, each run also sends ProjectDiscovery's update check (OS, architecture, version, hashed machine ID) unless you pass -duc.
• go.mod pins 173 packages with 13 advisories, including 2 critical and 1 high. The critical ones are memory-safety bugs in the pgx PostgreSQL driver, pulled in by Praetorian's Titus secrets library, which katana uses only for the opt-in secret features; the high one is in klauspost/compress's S2 format. The rest are golang.org/x/net, goldmark and openpgp notices. All are indirect, and katana is a CLI, not a server others connect to.
• Twelve workflows, none using pull_request_target; the 13 third-party action uses are pinned to tags, not commits. The repository has its own security policy, plus Dependabot and CodeQL.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Go 29.1K, JSON 19.5K, Markdown 2,068, YAML 769, JavaScript 719, Shell 63.

Questions

Is katana free?

Yes. katana is MIT-licensed and free for any use, commercial included. Only the optional extras cost money: a captcha-solving service if you enable one, and your own model API if you point -ai-url at a paid provider.

Is it legal to crawl a website with katana?

Crawling public pages is common, but katana is far more thorough than a search engine: it can fill in forms, follow every parameter and hit the same app thousands of times. Use it on sites you own, on a client's with written permission, or within a bug bounty programme's scope and rate limits. Do not validate secrets or solve captchas on sites you are not authorised to test.

Should I use standard or headless mode?

Start with standard mode plus -jc: it is much faster and finds most links and JavaScript endpoints. Switch to -headless for single-page apps built with React, Vue or Angular, where routes and API calls only appear after the scripts run. Headless mode needs Chrome and a lot more memory.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.