Katana (ProjectDiscovery)

What it is

A fast Go crawler that follows links, parses JavaScript, and lists every path it can reach on a site. It runs in a standard mode built on plain HTTP requests or a headless mode that drives a real browser for script-heavy pages.

What it helps with

- Discovering hidden endpoints and parameters before testing
- Crawling single-page apps through headless browsing
- Keeping crawls inside a defined scope with regex rules
- Extracting forms and inputs to JSON lines output

Who it's for

Recon practitioners, pentesters, and bug bounty hunters mapping web applications they are authorized to assess.

Worth knowing

It can fill forms automatically, an experimental feature, and accepts custom headers or cookies for authenticated crawls. Prebuilt binaries and a Docker image are published with each release.

Where does it fit in a recon chain?
In our view it sits after httpx confirms live hosts and before Nuclei scans the URLs it finds.

Can it read a list of targets?
Yes, it accepts single URLs, files, or piped input.