Your application passes all its tests. Forms validate data, Blade views escape what they display. Then one day, a forgotten search field echoes the typed text back into the page, unfiltered. Someone only had to try.

Attackers don't have access to our code. They explore the application from the outside, page by page, and test every parameter. In late October, Kali Linux 2026.3 added two tools that let you do the same on your own applications: katana and dalfox ( BleepingComputer ).

These tools are only to be used on applications you are responsible for, or with written authorization.

An attacker starts by mapping

Katana is a site crawler. It follows links, reads JavaScript and lists every URL and parameter it finds.…