AeonDave EyeWitness
Screenshots web services and produces an HTML report with categorized results.
Quick Start
# Screenshot from URL list
eyewitness -f urls.txt --web
# Screenshot from nmap XML
eyewitness -x nmap_scan.xml --web
# Specify output directory
eyewitness -f urls.txt --web -d output/eyewitness
Core Flags
| Flag | Description |
|---|---|
-f <file> |
Input file with URLs/hosts |
-x <xml> |
Nmap XML output file |
--web |
HTTP screenshotting (default) |
--rdp |
RDP screenshots |
--vnc |
VNC screenshots |
-d <dir> |
Output directory |
--no-prompt |
Skip interactive prompts |
--timeout <n> |
Per-target timeout (default 7s) |
--threads <n> |
Threads (default 10) |
--delay <n> |
Delay between requests |
--proxy-ip <ip> |
Proxy IP |
--proxy-port <port> |
Proxy port |
--resolve |
Resolve IP addresses |
--add-http-headers <h> |
Add custom headers |
--user-agent <ua> |
Custom user agent |
--prepend-https |
Prepend https:// to input |
--prepend-http |
Prepend http:// to input |
--active-scan |
Active fingerprinting |
--jitter <n> |
Jitter between screenshots |
Common Workflows
# Screenshot a subdomain list
cat subs.txt | sed 's/^/http:\/\//' > urls.txt
eyewitness -f urls.txt --web -d report/ --no-prompt
# From nmap scan + report
nmap -sV -p 80,443,8080,8443 -oX scan.xml 192.168.1.0/24
eyewitness -x scan.xml --web -d web_report/ --no-prompt
# With both HTTP and HTTPS
eyewitness -f hosts.txt --prepend-http --prepend-https --web -d out/
# RDP screenshot of internal network
eyewitness -f hosts.txt --rdp -d rdp_report/
Output
EyeWitness produces:
report.html— categorized screenshots with HTTP headers, page titles, response codesMatches/— signature-based categories (login pages, Cisco, Citrix, VMware, etc.)Screenshots/— raw screenshot images (PNG)Eyewitness.db— SQLite database with all results
Pipeline Integration
# From subfinder → httpx → eyewitness
subfinder -d target.com -silent | \
httpx -silent | \
tee live_hosts.txt | \
eyewitness --web -f /dev/stdin -d eyewitness_out/ --no-prompt
# From masscan/nmap port scan
masscan -p 80,443,8080,8443,8000,8888 192.168.1.0/24 -oX masscan.xml
eyewitness -x masscan.xml --web -d report/ --no-prompt
# Include non-standard ports (use httpx first)
cat hosts.txt | httpx -ports 80,443,8080,8443,3000,5000,8888 -silent | \
eyewitness --web -f /dev/stdin -d report/ --no-prompt
Resources
| File | When to load |
|---|---|
references/report-tips.md |
HTML report layout, signature categories, pipeline integration, DB queries |