Welcome back, aspiring cyberwarriors and bug bounty hunters!

When we work with web applications, we often need to effectively crawl and spider them to understand what we’re dealing with. But the main problem we might encounter is that a target web app is an SPA, or single-page application. This means that the website loads a single HTML file initially and dynamically updates the content within that page as the user interacts with it. Therefore, traditional crawling tools become ineffective with modern web applications.

To work with modern JavaScript frameworks, single-page applications, and sophisticated authentication mechanisms, we can use the Katana framework from ProjectDiscovery. Katana is a web crawler that allows you to discover hidden paths, parameters, and endpoints in web applications. It’s fast, modular, and supports multiple crawling techniques.

One of the most impressive aspects of Katana is its ability to handle JavaScript execution and dynamic content rendering. Traditional crawlers often miss critical functionality because they cannot execute JavaScript or understand how modern web applications dynamically generate content. Katana addresses this limitation by incorporating headless browser capabilities that allow it to fully render pages, execute JavaScript, and discover content that would otherwise remain hidden.

Let’s explore how to download, install, and utilize this powerful reconnaissance tool to enhance your web application security testing capabilities.

Installing Katana

There are few methouds of installing the tool. In this article, I’ll focus on installing using Go programming language.

First, verify if Go is already installed:

kali> go version

Install Katana using the Go package manager:

kali> go install github.com/projectdiscovery/katana/cmd/katana@latest

Verify the installation:

kali> katana -version

Crawling Modes

Katana supports two main crawling modes, each tailored to different types of web applications and use cases.

The Standard Mode is designed for speed and simplicity, making it ideal for traditional websites. It uses Go’s built-in HTTP library to handle requests and responses, parsing raw HTTP response bodies without executing JavaScript or rendering the DOM. This lightweight approach ensures fast performance but may miss endpoints in more complex applications that rely on browser-based events.

In contrast, the Headless Mode offers a more thorough crawl by simulating a real browser environment. This mode is especially useful for modern, JavaScript-heavy applications, as it captures both raw and rendered content. By mimicking a legitimate browser fingerprint (including TLS and user-agent headers), it improves coverage and detection of dynamic elements.

You can enable Headless Mode with the -headless flag and customize it further with several options:

• -sc / -system-chrome: Use the locally installed Chrome
• -sb / -show-browser: Show the browser window during execution
• -ho / -headless-options: Pass custom Chrome options
• -nos / -no-sandbox: Disable the Chrome sandbox (useful for root users)
• -cdd / -chrome-data-dir: Specify a custom Chrome data directory
• -scp / -system-chrome-path: Set a specific path to the Chrome executable
• -noi / -no-incognito: Disable incognito mode

Basic Website Reconnaissance

Let’s start with a fundamental reconnaissance scenario where we need to map a target website’s structure and discover all accessible endpoints. For this example let’s try to understand application’s structure of Vesti.ru – Russian news website.

kali> katana -u https://example-target.com -d 5 -c 10 -o target-crawl-results.txt

-u: Specifies the target URL

-d 5: Sets maximum crawling depth to 5 levels

-c 10: Uses 10 concurrent threads for faster crawling

-o: Saves all discovered URLs to a file

JavaScript-Heavy Application Crawling

Modern web applications often rely heavily on JavaScript for content generation. Here’s how to handle an AngularJS-based single-page application.

kali> katana -u https://angular-app.com -js-crawl -headless -timeout 30 -delay 2 -o angular-results.json

-js-crawl: Enables JavaScript execution during crawling to handle AngularJS controllers and directives

-headless: Uses headless Chrome for rendering AngularJS templates and executing digest cycles

-timeout 30: Sets 30-second timeout for page loads to accommodate AngularJS bootstrapping

-delay 2: Adds 2-second delay between requests to allow AngularJS routing transitions

Known Files Discovery

Crawl for common files like robots.txt and sitemap.xml that often reveal valuable information about website structure and hidden content. These files can provide insights into:

• robots.txt: Disallowed directories and files that may contain sensitive information
• sitemap.xml: Complete site structure including pages not linked from main navigation
• Other discovery files: Common configuration files, backup files, and administrative interfaces

kali> katana -u https://example.com -known-files all -d 3

Note that a minimum depth of 3 is required to ensure comprehensive discovery of all known files across the target application.

Filtering Capabilities

Katana offers robust filtering features that help users process, refine, and manage crawl output with precision. These capabilities make it easy to isolate valuable data, reduce noise, and tailor results to match specific goals.

Users can filter output by specific fields, include or exclude URLs based on extensions or regular expressions, and even define custom fields using a YAML configuration file. This flexibility is crucial for handling the often large volume of data produced during a crawl, ensuring that users can focus on the most relevant information.

Some key filtering options include:

• -field or -f: Display specific fields (e.g., url, path, fqdn, rdn)
• -store-field or -sf: Save selected fields to disk
• -extension-match or -em: Show only URLs with specific file extensions
• -extension-filter or -ef: Exclude URLs with specific file extensions
• -match-regex or -mr: Include URLs that match a regex pattern
• -filter-regex or -fr: Exclude URLs that match a regex pattern

Example:
To extract only .js URLs (including those with query parameters) and save their full URLs to a file, you could run:

kali> katana -u https://example.com -match-regex “\.js” -f url -sf url -o js-files.txt

Summary

Whether you’re conducting penetration tests, bug bounty research, or comprehensive cyberwar operations, Katana’s advanced capabilities and modern architecture make it an essential addition to your hacking toolkit.

If you’re serious about sharpening your offensive security skills, consider our Subscriber Pro package. It’s designed to take your expertise to the next level.

The post Web App Hacking: Katana, A Next-Generation Crawling and Spidering Framework first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

If you’ve spent any time hunting through vulnerability databases, you may have noticed a recurring trend involving a certain brand of budget networking gear. Tenda routers appear time and again, not because researchers have it in for the company, but because of persistent, systemic security failures that remain largely unaddressed. These issues have almost turned Tenda into a textbook example of what not to do when it comes to product security management.

In this article, we’ll explore the reasons behind Tenda’s notorious reputation, examine the modern threats posed by their devices, and dive into a practical lab to exploit one of their information-disclosure vulnerabilities. Let’s get rolling!

What is Tenda?

Tenda is a Chinese manufacturer of networking hardware, primarily recognized for offering budget-friendly equipment for home and small business networking. Their product lineup includes wireless routers, range extenders, network switches, and IP cameras.

At first glance, you might overlook Tenda as just a small Chinese company without significant influence. However, a quick search on Shodan reveals an entirely different story.

There are over 12,000 hosts that could potentially serve as gateways for both the Chinese government and hackers worldwide to access various networks.

Problem #1: A Culture of Silence

To understand the issues with Tenda, it’s essential to recognize a troubling pattern of behavior rather than focusing on a single vulnerability. When Carnegie Mellon’s CERT/CC identifies a significant backdoor in the firmware of several router models and reaches out to Tenda for a coordinated disclosure, one might expect a company of Tenda’s stature to acknowledge the issue and take steps toward a resolution. Unfortunately, that hasn’t been the case. CERT/CC’s recent advisory on this backdoor reveals that Tenda has remained silent since they were contacted in May 2026, with no patches released for any of the five affected router models.

This isn’t just a one-off incident. Back in 2020, researchers from Independent Security Evaluators discovered a hardcoded telnet password embedded in the Tenda AC15 AC1900. They notified the company and waited nearly double the standard 90-day disclosure period without receiving a response, ultimately publishing their findings without any acknowledgment from Tenda. If you look even further back to 2013, you’ll find a security researcher documenting a LAN-side backdoor in the Tenda W302R and W330R routers, which was also never patched. When a company remains unresponsive for over a decade and across multiple hardware iterations, it indicates a fundamental flaw in its business model rather than just a series of mistakes.

Problem #2: Hardcoded Credentials

The scale of Tenda’s problems becomes even clearer when looking at firmware analysis studies instead of individual disclosures. Research scanning extensive batches of Tenda firmware images has revealed that nearly one in five contain hardcoded default credentials or even empty passwords embedded directly in the binary. This isn’t a rare oversight; rather, it points to a recurring design choice made across an entire line of products. When you combine this statistic with a vendor that ignores security disclosures, it means Tenda is, in effect, distributing routers that come pre-loaded with vulnerable access points, easily exploitable by anyone who knows where to look.

Problem #3: The Backdoor that Makes Changing Your Password Meaningless

A particularly egregious example is CVE-2026-11405. This vulnerability deserves special attention due to the way it undermines the basic principles of router security. It resides within the login function of the httpd web server binary that runs on several router models. Typically, when a user submits a password, the router checks it using MD5-based verification. However, if this check fails, instead of simply rejecting the login attempt, the code unwittingly falls through to a second, undocumented authentication route. It retrieves a hidden configuration value called sys.rzadmin.password and directly compares it in plaintext to the password submitted by the attacker. If they match, the router grants administrative access at role level two, and critically, the username input during this attempt isn’t validated at all. This means that any username coupled with the correct backdoor password gains access.

Consider the implications for an average user who has followed all the right steps. You purchase the router, log into the web interface, and change the default admin password to a strong, unique one, just as every security guide advises. Unfortunately, none of that matters here since the backdoor password exists entirely outside the interface that you interacted with. It is stored in the device’s configuration, hidden from any user-facing menu and unaffected by any password changes you make through the regular admin panel. The only way to eliminate this risk is through a complete firmware rewrite from the vendor, and as of now, Tenda has provided no indication that such an update is forthcoming.

Problem #4: Crashing Devices Without Authentication

Backdoors aren’t the only serious vulnerability affecting this ecosystem. CVE-2026-36794 targets the Tenda W3 router and highlights a stack-based buffer overflow that an unauthenticated remote attacker can exploit simply by sending a specially crafted HTTP request.

There’s no need for a login or any user interaction; the attacker just requires network access to the device’s web interface. The consequence is a device crash, leading to a straightforward denial of service.

Practical Lab: Pulling Credentials Out of the Tenda N300

Now, let’s dive right in. While the recent backdoor vulnerability we discussed is certainly eye-catching for 2026, today we will focus on an older issue: CVE-2020-35391, which affects the Tenda N300. I have chosen this example intentionally, as it highlights a troubling trend within Tenda, specifically the consistent shipping of exploitable authentication flaws.

The issue lies in how the router manages configuration backup requests. Normally, an authenticated administrator can easily request a copy of the device’s configuration file for backup by accessing an endpoint at cgi-bin/DownloadCfg/RouterCfm.cfg. The problem arises because this endpoint fails to properly enforce authentication before releasing the file. An attacker can simply send a direct request to that endpoint and sometimes gain access to the complete configuration file. Once you have that configuration file, open it up and find the line labeled extend_pass.

That single line contains the administrative password for the router’s web interface, made accessible without any login credentials. From here, exploiting this vulnerability is straightforward. Just take that password, navigate to the router’s usual login page, and authenticate as the administrator. You will then have full control over the device, including its DNS settings, port forwarding rules, and every device connected behind it.

Summary

These days, Tenda hardware remains quite popular in various countries due to its affordability. However, we must be more cautious about security, as overlooking it could lead to significantly higher long-term costs.

If you’re interested in exploring how to both attack and secure routers, consider enrolling in the VPN & Router Hacking course. This course delves into router exploitation through manual RCE (Remote Code Execution), information disclosure, and unauthorized code execution on devices like Netgear, Netis, and Telesquare, as well as enterprise-grade systems like FortiPAM and FortiSwitchManager – and much more.

The post Router Hacking: Why the World’s Most Popular Budget Router Keeps Making Headlines for the Wrong Reasons first appeared on Hackers Arise.