security enabled verified low v1.0.0

katana

Fast web crawler and spider from ProjectDiscovery for discovering endpoints, assets, and attack surface.

📋 Live Preview

katana -u {target} -d {depth}

🌍 target → url 🌍 depth → 3

katana -u {target} -d {depth}

Sandbox: execFile · Timeout: 600s

Capabilities

web.discovery.endpoint

web.crawl.spider

web.enumeration.asset

web.discovery.js-source

Parameters

Name	Type	Required	Default	Description	Aliases
`url`	string	Yes	-	Target URL to crawl	`-u`, `--url`
`depth`	integer	No	3	Maximum crawl depth	`-d`, `--depth`
`js-crawl`	boolean	No	-	Enable JavaScript parsing and crawling	`-jc`, `--js-crawl`
`extension-match`	string	No	-	Only crawl URLs matching extensions	`-em`, `--extension-match`
`extension-filter`	string	No	-	Filter out URLs matching extensions	`-ef`, `--extension-filter`
`known-files`	string	No	-	Check for known files (robots.txt, sitemap.xml)	`-kf`, `--known-files`
`max-response-size`	integer	No	5242880	Maximum response body size in bytes	`-mrs`, `--max-response-size`
`output`	string	No	-	Write output to file	`-o`, `--output`
`json`	boolean	No	-	Write output in JSON lines format	`-oJ`, `--json`
`status-code`	string	No	-	Filter by status code (e.g. 200,302)	`-sc`, `--status-code`
`content-type`	string	No	-	Filter by content type	`-ct`, `--content-type`
`headers`	string	No	-	Custom HTTP headers	`-H`, `--headers`
`proxy`	string	No	-	HTTP proxy address	`-p`, `--proxy`
`threads`	integer	No	10	Number of concurrent threads	`-t`, `--threads`
`rate-limit`	integer	No	-	Maximum requests per second	`-rl`, `--rate-limit`
`timeout`	integer	No	10	Request timeout in seconds	`-timeout`, `--timeout`
`silent`	boolean	No	-	Suppress output banner and progress	`-silent`, `--silent`
`verbose`	boolean	No	-	Verbose output	`-v`, `--verbose`
`field`	string	No	url	Fields to display in output	`-f`, `--field`
`automatic-form-fill`	boolean	No	-	Automatically fill forms for crawling	`-aff`, `--automatic-form-fill`
`insecure`	boolean	No	-	Skip TLS certificate verification	`-k`, `--insecure`
`no-headless`	boolean	No	-	Disable headless browser crawling	`-nh`, `--no-headless`
`aff`	boolean	No	-	forms	`-aff`, `--automatic-form-fill`, `-fill`
`ct`	boolean	No	-	TYPE Content type filter	`-ct`, `--content-type`
`mrs`	boolean	No	-	N Max response size (default: 5242880)	`-mrs`, `--max-response-size`
`nh`	boolean	No	-	Disable headless	`-nh`, `--no-headless`
`v`	boolean	No	-	Verbose mode	`-v`, `--verbose`

Artifacts

Type	Description	MIME	Schema	Trust
`crawl.json`	Crawl results as JSON lines	application/json	-	verified
`crawl.txt`	Crawl results as text output	text/plain	-	verified

Contract

Inputs

web.target.url

Target URL to crawl

web.target.domain

Target domain to scope the crawl

web.crawl.depth

Maximum crawl depth

Outputs

crawl.json

Discovered endpoints as JSON

crawl.txt

Discovered endpoints as text

Side effects: network_trafficnetwork_traffic

Workflow Edges

Produces

crawl.jsoncrawl.txt

Consumes

web.target.urlweb.target.domainweb.crawl.depth

Resource Profile

Resource	Value
CPU	low
Memory	128 MB
Network	medium
Disk I/O	low

Examples

Basic crawl with default depth

katana -u http://target.com

Deep crawl with JavaScript parsing

katana -u http://target.com -d 5 -jc

Filter by specific extensions

katana -u http://target.com -em php,asp,js

Output crawled URLs as JSON

katana -u http://target.com -oJ -o endpoints.json

Crawl with proxy and rate limiting

katana -u http://target.com -p http://127.0.0.1:8080 -rl 50

Silent mode with filtered status codes

katana -u http://target.com -silent -sc 200,302

Documentation

Katana — Web Crawler and Spider

Katana is a fast web crawler from ProjectDiscovery designed for discovering endpoints, JavaScript sources, and hidden assets. It supports both standard HTTP crawling and headless browser-based crawling for JavaScript-heavy applications.

Basic Usage

# Basic crawl
katana -u http://target.com

# Deep crawl with JS parsing
katana -u http://target.com -d 5 -jc

# Output as JSON
katana -u http://target.com -oJ -o crawl.json

# Crawl with rate limiting
katana -u http://target.com -rl 50 -t 5

Crawl Modes

Mode	Flag	Description
Standard	(default)	HTTP-based crawling
JS Crawl	`-jc`	Parse JavaScript for URLs
Headless	(default)	Headless browser for JS-heavy sites
Form Fill	`-aff`	Auto-fill forms during crawl

Related Tools

gospiderhakrawleraquatone