Katana

ProjectDiscovery Katana is a modern, next-generation web crawling and spidering framework engineered for security practitioners, bug bounty researchers, and penetration testers seeking to uncover hidden endpoints and discover comprehensive attack surfaces across modern dynamic web applications. Developed in Go, Katana combines standard headless HTTP crawling with fully automated Chromium headless browser rendering.

The framework operates effortlessly across Linux, macOS, and Windows operating systems via a command-line interface or containerized Docker deployments. Core technical capabilities include recursive crawling, automated JavaScript parsing, dynamic DOM analysis, endpoint route extraction, customizable crawling depth and concurrency limits, automatic form submission, and structured JSON output streaming. By executing client-side scripts within a headless browser, Katana successfully extracts hidden API routes and dynamic single-page application (SPA) links that evade traditional static spiders.

Security engineering and DevSecOps teams integrate Katana into continuous security scanning workflows alongside tools like subfinder, httpx, and nuclei. Common operational use cases include mapping external attack surfaces, feeding clean URL inventories into automated vulnerability scanners, discovering undocumented API endpoints, and assessing web application routing architectures. Offering unmatched crawl speeds, low resource footprints, and resilient parsing engines, Katana represents a modern cornerstone utility for dynamic web application discovery and offensive security research.