> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/projectdiscovery-tools/katana.md).

# Katana

**Katana** is a web crawler developed by [ProjectDiscovery](https://projectdiscovery.io/). Katana is optimized for speed, flexibility, and automation in web reconnaissance.

* [GitHub Repository: Katana](https://github.com/projectdiscovery/katana)

***

### **Key Features**

* **High-Speed Web Crawling** – Optimized for large-scale reconnaissance.
* **JavaScript Parsing** – Extracts links from dynamically loaded content.
* **Customizable Depth & Scope** – Control crawl depth and target URLs.

***

### **Installation & Setup**

To install **Katana**, use the following command:

```bash
GO111MODULE=on go install -v github.com/projectdiscovery/katana/cmd/katana@latest
```

To make `katana` globally accessible:

```bash
sudo cp ~/go/bin/katana /usr/local/bin
```

Verify installation:

```bash
katana -h
```

***

### **Usage Examples**

* **Basic Web Crawling**

  ```bash
  katana -u https://example.com
  ```
* **Crawl with a List of URLs**

  ```bash
  katana -list urls.txt
  ```
* **Extract JavaScript-Based Endpoints**

```bash
katana -u https://example.com -js
```

* **Set Crawl Depth**

```bash
katana -u https://example.com -d 3
```

* **Save Results in JSON Format**

```bash
katana -u https://example.com -o output.json -json
```

* **Include Subdomains in Crawling**

```bash
katana -u https://example.com -subs
```

* **Crawl with a Specific User-Agent**

```bash
katana -u https://example.com -H "User-Agent: CustomScanner"
```

* **Limit Number of Concurrent Requests**

```bash
katana -u https://example.com -c 5
```

* **Extract Endpoints from JavaScript Files Only**

```bash
katana -u https://example.com -js -output endpoints.txt
```

* **Follow Only In-Scope Links**

```bash
katana -u https://example.com -scope subs
```

* **Exclude Specific Paths from Crawling**

```bash
katana -u https://example.com -exclude /admin,/login
```

* **Crawl with Custom Headers and Affinity Filtering**

```bash
katana -list katana-scan-list.txt -H header.txt -aff -silent -rl 100 -cos community.front.com,onboarding.front.com
```

* **Crawl Using a Proxy and Cookies**

```bash
katana -list katana-scan-list.txt -cos community.front.com,onboarding.front.com -proxy http://127.0.0.1:8080/ -H cookie.txt -o katana-output.txt
```

### **Connecting to an Active Browser Session**

* **Open Browser and Start Debugging Session**

  ```bash
  /usr/bin/chromium --remote-debugging-port=1000
  ```
* After running, you will see output like:

  ```
  DevTools listening on ws://127.0.0.1:1000/devtools/browser/743ad29c-d726-45a6-b2f4-4e0e4153794e
  ```
* Pick the WebSocket URL:

  ```
  ws://127.0.0.1:1000/devtools/browser/743ad29c-d726-45a6-b2f4-4e0e4153794e
  ```
* **Run Katana in Headless Mode with Active Browser Session**

  ```bash
  katana -headless -u https://app.frontapp.com -cwu ws://127.0.0.1:1000/devtools/browser/743ad29c-d726-45a6-b2f4-4e0e4153794e -no-incognito
  ```

  ```bash
  katana -headless -u https://app.frontapp.com -cwu ws://127.0.0.1:1000/devtools/browser/f776cb14-b21a-4137-bbd8-d0a06d144b58 -no-incognito
  ```

WebSocket Example:

```
ws://127.0.0.1:1000/devtools/browser/f776cb14-b21a-4137-bbd8-d0a06d144b58
```