Cracken + Katana
Cracken runs Katana in headless mode to crawl a site the way a browser does, surfacing the endpoints and parameters buried in its JavaScript. It feeds them into the rest of the operation.
Connecting Katana
- Connect with
No credentials — runs on your own Tentacle
- Cadence
Runs on demand — installed on a Tentacle, then invoked during an operation (the agent can install and uninstall it mid-run)
- Requires
A Tentacle running Linux or macOS. Free licence, nothing to purchase and no credentials to supply.
What Cracken gets from Katana
Crawled endpoints broken out as url, path, fqdn, rdn, rurl, qurl, qpath, file, ufile, dir and udir
Query parameter keys and values (key, value, kv)
Form elements — form, input, textarea and select — with -form-extraction
XHR request URLs and methods captured during headless crawling
Detected technologies (-tech-detect)
Full HTTP requests and responses, optionally stored per host to disk
Knowledge-base classification and page-type classification (error, captcha, parked)
JSONL output whose available fields are enumerable with -list-output-fields
What Katana does not do
Katana crawls and extracts; nothing in its flag set tests, injects or authenticates against what it maps. Several of the capabilities that widen coverage are marked experimental by the vendor — automatic form filling, headless hybrid crawling and TLS (ja3) impersonation — and by default it drops similar-looking URLs and a default extension list, so some routes only appear once you turn those filters off.
How Cracken uses Katana
- 01
Install Katana on a Tentacle
- 02
Point it at a live host
- 03
Test what the crawl exposed
- 04
Confirm the Tentacle is ready
Frequently asked questions
Will Katana's crawl wander outside the site I authorised?
Katana's field and regex scope controls bound a crawl to authorised domains and paths, which Cracken sets when it composes the command.
Does Katana find endpoints that a normal crawler misses?
Yes; Katana's headless browser runs a page's JavaScript, surfacing XHR calls, single-page-app routes, and form parameters that never appear as plain links.
“I've been pretty impressed with how CrackenAGI is able to do its vulnerability discovery, enumeration, reconnaissance, as well as eventually being able to actually execute different exploitation paths.”
More integrations
Attack with real Katana context.
See how Cracken runs Katana on a Tentacle you host, and proves what it finds end to end.