diff --git a/strix/skills/tooling/katana.md b/strix/skills/tooling/katana.md index 66b4928d..7bece109 100644 --- a/strix/skills/tooling/katana.md +++ b/strix/skills/tooling/katana.md @@ -24,7 +24,15 @@ High-signal flags: - `-p, -parallelism ` concurrent input targets - `-rl, -rate-limit ` request rate limit - `-timeout ` request timeout +- `-ct, -crawl-duration ` maximum time to crawl the target - `-retry ` retry count +- `-mdp, -max-domain-pages ` cap pages crawled per domain (default: unlimited) +- `-fsu, -filter-similar` collapse similar URLs (e.g. /users/123 and /users/456) +- `-fs, -field-scope ` crawl scope (default `rdn` = root domain + ALL subdomains) +- `-f, -field ` emit only one field (e.g. `-f url` for a plain URL list) +- `-or, -omit-raw` omit raw request/response from JSONL output +- `-ob, -omit-body` omit response body from JSONL output +- `-mrs, -max-response-size ` cap per-response bytes read (default 4194304) - `-ef, -extension-filter ` extension exclusions - `-tlsi, -tls-impersonate` experimental JA3/TLS impersonation - `-hl, -headless` enable hybrid headless crawling @@ -37,7 +45,7 @@ High-signal flags: - `-silent`, `-j, -jsonl`, `-o ` output controls Agent-safe baseline for automation: -`mkdir -p crawl && katana -u https://target.tld -d 3 -ct 10m -jc -kf robotstxt -c 10 -p 10 -rl 50 -timeout 10 -retry 1 -ef png,jpg,jpeg,gif,svg,css,woff,woff2,ttf,eot,map -silent -j -o crawl/katana.jsonl` +`mkdir -p crawl && katana -u https://target.tld -d 3 -ct 10m -mdp 2000 -fsu -jc -kf robotstxt -c 10 -p 10 -rl 50 -timeout 10 -retry 1 -ef png,jpg,jpeg,gif,svg,css,woff,woff2,ttf,eot,map -silent -j -o crawl/katana.jsonl` Common patterns: - Fast crawl baseline: @@ -59,11 +67,12 @@ Critical correctness rules: - For `-kf`, keep depth at least `-d 3` so known files are fully covered. - If writing to a file, ensure parent directory exists before `-o`. -Keeping output manageable: -- katana does not cap its own output size, so bound crawls with `-ct` (crawl-duration) and `-d` (depth); on large sites an unbounded `-jsl` / `-kf all` deep crawl can grow very large. -- Reserve deep JS crawling (`-jsl`, `-kf all`, higher `-d`) for a specific narrowed target rather than broad scopes. -- After a crawl, glance at output size (`du -sh `); if it looks outsized for the scope, tighten `-d`/`-ct`/`-ef` or split per host. -- For JSONL output, extract and dedupe URLs before use (`jq -r '.url' | sort -u > urls.txt`), then remove the raw `.jsonl` once you've preserved any metadata you still need. +Keeping output small (katana has NO default page cap, so plan for volume): +- Bound scope and volume: `-fs fqdn` (or `-cs`/`-cos` regex) so the crawl doesn't wander across every subdomain, `-mdp ` to cap pages per domain, `-fsu` to collapse near-identical URLs, and `-ct`/`-d` to bound time and depth. +- Shrink each record: default JSONL is verbose. If you only need endpoints, emit a plain URL list with `-f url` instead of `-j`. If you need JSONL, drop the heavy parts with `-or` (omit raw) and `-ob` (omit body), and lower `-mrs` to cap per-response bytes. +- Reserve `-jsl` / `-kf all` / higher `-d` for a specific narrowed target — they multiply output fast on large sites. +- Reduce, then delete: once the crawl finishes, extract just what you need (e.g. `katana ... -f url -o urls.txt` or `sort -u` a URL list, or a short note of interesting paths) and remove the raw crawl file/dir. Don't keep large raw crawls around after you've distilled them. +- Sanity-check size (`du -sh `); if it's outsized for the scope, tighten `-fs`/`-mdp`/`-fsu`/`-d`/`-ct` and re-run rather than keeping it. Usage rules: - Keep `-d`, `-c`, `-p`, and `-rl` explicit for reproducible runs.