katana-crawl

Crawl web targets with JavaScript rendering to discover hidden endpoints and API surfaces.

1.6k|234|Updated Dec 7, 2019

Search Tags:#spa #headless #crawl #endpoint-discovery #katana #web-endpoints #js-endpoint-discovery

Ready to run

npx skills add https://github.com/wgpsec/AboutSecurity --skill katana-crawl

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: katana-crawl
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/tool/katana-crawl
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill katana-crawl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Crawling modern websites to uncover hidden endpoints, dynamic API surfaces, and JavaScript-driven paths that traditional crawlers miss, enabling faster security testing and site mapping.

Core Features & Use Cases

JavaScript endpoint discovery: render SPA pages to extract endpoints and APIs.
Headless and standard modes: switch between rendering and plain crawling for efficiency.
Phase-based workflow and pipeline-friendly output suitable for integration with other tools (e.g., nuclei, httpx, subfinder).

Quick Start

Run katana against a target to begin crawling and reveal hidden endpoints.

Frequently Asked Questions about katana-crawl

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I crawl a SPA to discover hidden web endpoints and API surfaces?▼

Headless rendering executes client-side JavaScript on SPA pages, allowing the crawler to extract dynamically loaded API surfaces and JS-driven paths that standard static fetching misses.

Can I use headless crawling to extract JavaScript endpoints for security testing?▼

Yes, headless crawling extracts JavaScript endpoints by rendering SPA pages, making it suitable for reconnaissance and security assessments to uncover hidden API surfaces for testing.

What is the best way to integrate web endpoint discovery with nuclei or httpx pipelines?▼

The best way to integrate endpoint discovery with pipelines is using phase-based crawling with pipeline-friendly output, allowing the extracted endpoints to feed directly into tools like nuclei and httpx.

Does katana support both headless rendering and standard crawling modes?▼

Yes, it supports both headless rendering and standard crawling modes, letting you switch between full JavaScript execution for deep SPA discovery and plain crawling for faster, efficient site mapping.

When should I use JavaScript rendering for site mapping instead of standard crawling?▼

Use JavaScript rendering for site mapping when targeting modern SPAs where dynamic content and routes are generated client-side, whereas standard crawling suffices for static HTML pages.