README
¶
K A T A N A X
A next-generation crawling and spidering framework, Foxcorn Lab edition
Features • Install • Usage • Issues
thc-katanax is a fork of projectdiscovery/katana (v1.8.0), rebased clean and rebranded for Foxcorn Lab. Crawler core is byte-identical to upstream — this fork exists for a maintained build under our org with the update hook repointed to our releases.
Features
- Fast and fully configurable web crawling
StandardandHeadlessmodesJavaScriptparsing / crawling- Customizable automatic form filling
Scopecontrol — preconfigured fields / regexKnowledge base— ML page-type / form classification (auto-downloaded model)- Customizable output — preconfigured fields,
STDOUT/FILE/JSON - Input —
STDIN,URL,LIST
Full feature docs live upstream: katana README.
Install
katana needs Go 1.26+ (CGO_ENABLED=1 for the headless engine).
CGO_ENABLED=1 go install github.com/foxcornlab/thc-katanax/cmd/katana@latest
Or build it yourself:
git clone https://github.com/foxcornlab/thc-katanax.git
cd thc-katanax
go build -o katanax ./cmd/katana
Or with docker:
docker build -t thc-katanax .
docker run thc-katanax -u https://target.com
Usage
katanax -u https://target.com
echo https://target.com | katanax
katanax -list targets.txt -d 3 -js-crawl -o urls.txt
Full flag reference is upstream: katanax -h prints everything, and the usage docs apply as-is.
Only crawl targets you own or are authorised to test.
Thanks to
- ProjectDiscovery for
katana— the crawler core, the headless engine, and the docs this fork stands on. - The upstream contributors who keep the thing sharp.
Disclaimer
Built for authorised security testing and research only. You are responsible for how you use it — don't point it at systems you don't have permission to test.
Licence
MIT — see LICENSE.md. Upstream copyright ProjectDiscovery kept intact.
Research by
Vineeth Kumar(foxcornlab). Found a bug or want a feature, open anissue.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
functional-test
command
|
|
|
integration-test
command
|
|
|
katana
command
|
|
|
tools/crawl-maze-score
command
|
|
|
internal
|
|
|
testutils/authlab
Package authlab provides a self-hosted mini web app used to exercise Katana recorded-flow / auto-login authentication end-to-end.
|
Package authlab provides a self-hosted mini web app used to exercise Katana recorded-flow / auto-login authentication end-to-end. |
|
pkg
|
|
|
engine/headless/browser/cookie
Package cookie implements cookie consent handling for the crawler.
|
Package cookie implements cookie consent handling for the crawler. |
|
engine/headless/browser/stealth
from stealth go-rod
|
from stealth go-rod |
|
engine/headless/crawler/normalizer/simhash
Package simhash implements SimHash algorithm for near-duplicate detection.
|
Package simhash implements SimHash algorithm for near-duplicate detection. |
|
engine/headless/graph
Package graph implements a Directed Graph for storing state information during crawling of a Web Application.
|
Package graph implements a Directed Graph for storing state information during crawling of a Web Application. |
|
engine/hybrid
Package hybrid implements the functionality for a hybrid-headless crawler.
|
Package hybrid implements the functionality for a hybrid-headless crawler. |
|
engine/standard
Package standard implements the functionality for a non-headless crawler.
|
Package standard implements the functionality for a non-headless crawler. |
|
knowledgebase
Package knowledgebase defines the Extractor interface implemented by per-class detectors that contribute structured facts to a response's KnowledgeBase map.
|
Package knowledgebase defines the Extractor interface implemented by per-class detectors that contribute structured facts to a response's KnowledgeBase map. |
|
knowledgebase/extractors/endpoints
Package endpoints is a knowledgebase.Extractor that classifies a crawled request as an API endpoint (REST, GraphQL, SOAP, AJAX/XHR) by inspecting method, URL, headers, and content types.
|
Package endpoints is a knowledgebase.Extractor that classifies a crawled request as an API endpoint (REST, GraphQL, SOAP, AJAX/XHR) by inspecting method, URL, headers, and content types. |
|
knowledgebase/extractors/secrets
Package secrets is a knowledgebase.Extractor that detects exposed credentials in crawled response bodies using Praetorian's Titus engine.
|
Package secrets is a knowledgebase.Extractor that detects exposed credentials in crawled response bodies using Praetorian's Titus engine. |