Katana — The Cyber Toolchain

Katana v1.8.0

Mon, 05 Oct 2026 13:28:18 GMT

Katana v1.8.0 adds recorded-flow headless auth replay, chrome-headless-shell support, and per-page crawl hooks for the hybrid engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `-rf` / `--recorded-flow` flag to replay a Chrome DevTools Recorder JSON (or explicit steps file) before a headless crawl, enabling authenticated crawling without manual session setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `BrowserContextID` exposure to the hybrid crawler, allowing callers to correlate crawl traffic to a specific browser context. • Adds optional per-page `BeforeNavigate` and `AfterLoad` hooks to the hybrid engine, enabling custom logic to run at each page lifecycle event during a crawl. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana

Katana v1.7.0

Wed, 05 Aug 2026 15:43:30 GMT

Katana v1.7.0 adds secrets/endpoints extractors to the knowledge base, content similarity deduplication, and headless callbacks. • Adds `-kb-secrets` flag to enable a secrets extractor within the knowledge base, automatically detecting exposed credentials and tokens during crawls. • Adds `-kb-validate-secrets` flag to validate detected secrets live against their respective providers (sends real API calls). • Adds `-kb-endpoints` flag to enable an endpoints extractor that classifies REST, GraphQL, SOAP, and XHR requests found during crawling. • Adds `-pcs` / `-page-content-similar` flag for Layer-2 content similarity filtering to deduplicate near-identical pages during crawls, with configurable mode via `-pcsm` / `-page-content-similar-mode` (simhash, tfidf, or bm25; default `simhash`). • Adds `-pcsd` / `-page-content-similar-distance` (SimHash max Hamming distance, default 3), `-pcst` / `-page-content-similar-threshold` (TF-IDF/BM25 min score 0–1, default 0.85), and `-pcsn` / `-page-content-similar-budget` (pages fully processed per similarity cluster, default 1) flags to tune deduplication behaviour. • Adds `-sdd` / `-similarity-deduplication` as a convenience alias for `-pcs`. • Adds callbacks to the headless engine, enabling programmatic interception of headless browser events. • Adds a `Context` field to the `Options` struct for external lifecycle control — cancelling the provided `context.Context` stops the rate limiter, crawl session, queue, known-files requests, and headless browser. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana

Katana v1.6.0

Mon, 04 May 2026 08:42:27 GMT

Katana v1.6.0 adds automatic login, per-domain page budgets, per-host rate limiting, and page load strategy control. • Adds automatic login support for crawling authenticated targets. • Adds per-host rate limiting with adaptive backoff to avoid overwhelming individual hosts. • Adds `-pls`/`-page-load-strategy` flag to control browser page load timing (heuristic, load, domcontentloaded, networkidle, none). • Makes jsluice cgo-free, removing the CGo build dependency for easier cross-compilation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana

Katana v1.4.0

Tue, 06 Jan 2026 11:15:11 GMT

Katana v1.4.0 adds headless browser crawling with optional visual display and diagnostic logging. • Adds `-headless` flag to run a full headless browser crawler, enabling JavaScript-rendered page crawling. • Adds `-show-browser` flag to visually display the headless browser during crawling for debugging and inspection. • Adds `-enable-diagnostics` flag to write diagnostic information to a new directory alongside verbose logging for investigating crawl state failures. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana

Katana v1.2.2

Sat, 30 Aug 2025 16:47:48 GMT

Katana v1.2.2 adds cookie support during crawls and an option to disable the unique content filter. • Adds cookie support during crawling, enabling authenticated or session-aware crawl workflows. • Adds option to disable the unique content filter, allowing duplicate content to be captured during crawls. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana

Katana v1.1.2

Mon, 02 Dec 2024 10:30:58 GMT

Katana v1.1.2 adds content-length field in output and makes technology detection opt-in via new `-tech-detect` flag. • Adds `content_len` field to crawl output for captured responses. • Introduces `-td` / `-tech-detect` flag to explicitly opt into technology detection (works with JSONL output). Breaking changes: • Technology detection is no longer enabled by default; existing workflows that relied on automatic tech detection must now pass `-tech-detect` explicitly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana

Katana v1.1.1

Mon, 28 Oct 2024 13:38:52 GMT

Katana v1.1.1 adds no-clobber output protection, per-host field directory control, htmx endpoint extraction, and auto form-filling for select/textarea. • Adds `-ncb`/`-no-clobber` flag to prevent overwriting existing output files during a crawl. • Adds `-sfd`/`-store-field-dir` flag to save per-host fields to a custom directory instead of the default location. • Adds a response parser that extracts endpoints from htmx attributes, broadening JavaScript-heavy app coverage. • Adds automatic form filling for `

` elements to improve crawl depth on forms.
• Expands JavaScript library fingerprint coverage to improve endpoint parsing across more frameworks.
• Chrome launcher now prioritizes the path specified with `-scp` over system default Chrome paths in headless mode.
Breaking changes:
• Passive crawling flags `-ps`/`-passive` and `-pss`/`-passive-source` are removed from katana; the capability has been spun out into the separate `urlfinder` project.
Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana
</article>
<article>
<h1>Katana v1.1.0</h1>
<p>Tue, 26 Mar 2024 09:21:33 GMT</p>
Adds passive crawling via `-passive` and passive sources, plus host exclusion filters.
• `-ps, -passive` flag enables passive sources for URL discovery.
• `-pss, -passive-source string[]` allows selecting specific passive sources (waybackarchive, commoncrawl, alienvault).
• `-e, -exclude string[]` flag excludes targets based on filters like 'cdn', 'private-ips', cidr, ip, or regex.
Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana
</article>
<article>
<h1>Katana v1.0.5</h1>
<p>Thu, 11 Jan 2024 22:04:21 GMT</p>
Katana v1.0.5 adds the `-disable-redirects` flag to control redirect following behavior
• Adds the `-dr` (and `--disable-redirects`) CLI flag to disable following HTTP redirects
Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana
</article>
<article>
<h1>Katana v1.0.4</h1>
<p>Thu, 14 Sep 2023 17:35:36 GMT</p>
Adds `-fs` custom regex scope, `-disable-redirects`, and `-resume` options to Katana v1.0.4
• Added `-fs` flag for custom regex field scope control
• Added `-dr` / `-disable-redirects` option to stop following redirects
• Added `-resume` crawl option to resume scans from a previous run
Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana
</article>
<article>
<h1>Katana v1.0.3</h1>
<p>Tue, 01 Aug 2023 12:26:06 GMT</p>
Katana v1.0.3 adds DSL response matching/filtering, jsluice parsing, XHR extraction, TLS randomization and existing Chrome instance support
• `-mdc` / `-match-condition` adds DSL-based advance response matcher to filter URLs by response content.
• `-fdc` / `-filter-condition` adds DSL-based advance response filter to exclude URLs by response content.
• `-tlsi` / `-tls-impersonate` enables experimental client hello (ja3) TLS connection randomization.
• `-jsl` / `-jsluice` enables jsluice based javascript parsing for enhanced endpoint discovery.
• `-fx` / `-form-extraction` extracts form, input, textarea & select elements in jsonl output.
• `-xhr` / `-xhr-extraction` extracts XHR request URL and method in jsonl output.
• `-cwu` / `-chrome-ws-url` allows Katana to connect to an existing Chrome browser instance via debugger URL.
Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana
</article>
<article>
<h1>Katana v1.0.2</h1>
<p>Mon, 12 Jun 2023 22:40:50 GMT</p>
Katana v1.0.2 adds header file input and JSONL output filtering flags
• Adds `-H` flag to load custom headers from a file for authenticated crawling scenarios
• Adds `-omit-raw` / `-or` flag to exclude raw requests and responses from JSONL output
• Adds `-omit-body` / `-ob` flag to exclude response bodies from JSONL output
Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana
</article>
<article>
<h1>Katana v1.0.1</h1>
<p>Sat, 08 Apr 2023 08:37:40 GMT</p>
Adds `-iqp` flag to ignore crawling paths with different query parameters
• Adds `-iqp` (`-ignore-query-params`) flag to prevent crawling the same path when only query parameter values differ
• Adds support for automatically prepending URL schemes (http/https) to input URLs when not specified
Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana
</article>
<article>
<h1>Katana v1.0.0</h1>
<p>Mon, 20 Mar 2023 11:03:10 GMT</p>
Katana v1.0 adds request/response correlation, Wappalyzer tech detection, and regex match/filter flags.
• `-r` / `-resolvers` flag allows specifying a list of custom DNS resolvers (file or comma-separated)
• `-mr` / `-match-regex` and `-fr` / `-filter-regex` flags enable regex match and filter on discovered endpoint URLs
• JSON output now includes `request` and `response` fields containing the raw HTTP request, response headers, status code, body, and detected technologies via Wappalyzer
Breaking changes:
• The JSON output structure has changed: flat fields like `endpoint`, `source`, `tag`, and `attribute` are now nested under `request`, and a new `response` field containing `status_code`, `headers`, `body`, and `technologies` is added.
Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana
</article>
<article>
<h1>Katana v0.0.3</h1>
<p>Fri, 13 Jan 2023 13:29:13 GMT</p>
Katana v0.0.3 adds `-scp` for local chrome binary, `-elog` for error logs, `-hc` health-check, and raw HTTP store support
• Added the `--chrome-path` flag (`-scp`) to specify a local Chrome binary for headless browsing
• Added the `--error-log` flag (`-elog`) to write error logs to a file instead of stderr
• Added the `--health-check` flag (`-hc`) for self-diagnostic functionality
Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana
</article>
<article>
<h1>Katana v0.0.2</h1>
<p>Fri, 11 Nov 2022 09:42:21 GMT</p>
Adds `-no-sandbox` and `-headless-options` flags to control headless Chrome execution
• Adds `--no-sandbox` flag to run the headless browser in root environments where sandboxing is unavailable
• Adds `--headless-options` argument to pass arbitrary Chrome command-line flags directly to the underlying headless instance
Full history on Cyber Toolchain: https://cybertoolchain.io/tools/katana
</article>
</main></body></html>