Authorized Web Crawling With ProjectDiscovery Katana

Use Katana as a crawler and inventory tool, not as an autonomous vulnerability scanner. Produce scoped URL, route, endpoint, form, XHR, and technology evidence that a human or later task can review.

Workflow

1. Confirm authorization and scope before running Katana.

   • Accept owned apps, explicit pentest/bug bounty scope, internal test systems, and CTF/lab targets.
   • If the user gives a real third-party target without scope, ask for authorization/scope before crawling.
   • Define in-scope hosts, out-of-scope hosts, max depth, duration, concurrency, and rate limit.

2. Check Katana availability.

   • Run katana -version or katana -h.
   • If missing, suggest go install github.com/projectdiscovery/katana/cmd/katana@latest or the official Docker image.
   • Do not install system browsers or large dependencies unless the user asked for headless crawling and approves the install.