# Gowitness

> Use for visual triage of web assets, login portals, and exposed interfaces during authorized pentests. Trigger on screenshot capture, human review of web surfaces, and attack surface prioritization.

- Skill: `timsonner/gowitness` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/gowitness`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/gowitness/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/gowitness

---


# Gowitness

## Purpose

Use this skill to add fast visual context to a confirmed web inventory.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Threat Modeling and Test Planning
- Retest use: confirm that a risky interface is no longer exposed or has changed as expected

## Use When

- Need a human-friendly view of exposed web assets.
- Need to identify admin interfaces, default pages, or stale portals quickly.
- Need screenshots as clean report evidence.

## Avoid When

- No confirmed web surface exists.
- Capturing screenshots would expose sensitive data unnecessarily.

## Inputs

- Confirmed web URLs from `httpx` or known inventory
- Screenshot retention and redaction requirements

## Procedure

1. Capture only approved and confirmed URLs.
2. Review screenshots for login portals, admin pages, and obvious segregation mistakes.
3. Tag high-value targets for manual review in `burp-suite`.
4. Use the visual set to refine the test plan and reporting narrative.
5. Redact or separate any sensitive captures before sharing.

## Command Syntax

Replace sample targets with approved in-scope assets. Syntax can vary by version.

```bash
# Screenshot a single target
gowitness scan single --url https://portal.contoso.com

# Screenshot from a list of live URLs
gowitness scan file -f contoso-live.txt

# Scan a CIDR range on port 443
gowitness scan cidr --cidr 10.10.10.0/24 --port 443

# Set resolution and timeout
gowitness scan file -f contoso-live.txt --timeout 15

# Generate HTML report from captured screenshots
gowitness report generate
```

## Evidence to Capture

- Screenshots tied to exact URLs and timestamps
- Administrative or unexpected interfaces
- Visual confirmation of decommissioning drift or stale exposure

## Safety Boundaries

- Minimize screenshot capture of sensitive user data.
- Keep evidence handling aligned with the engagement's data rules.