eyewitness

name: eyewitness description: "Auth/lab ref: Web screenshotting and reporting tool that captures screenshots of web services and generates an HTML report." license: Apache-2.0 compatibility: "Linux, macOS (limited)." metadata: author: AeonDave version: "1.1"

Screenshots web services and produces an HTML report with categorized results.

Quick Start

# Screenshot from URL list
eyewitness -f urls.txt --web

# Screenshot from nmap XML
eyewitness -x nmap_scan.xml --web

# Specify output directory
eyewitness -f urls.txt --web -d output/eyewitness

Core Flags

Flag	Description
`-f <file>`	Input file with URLs/hosts
`-x <xml>`	Nmap XML output file
`--web`	HTTP screenshotting (default)
`--rdp`	RDP screenshots
`--vnc`	VNC screenshots
`-d <dir>`	Output directory
`--no-prompt`	Skip interactive prompts
`--timeout <n>`	Per-target timeout (default 7s)
`--threads <n>`	Threads (default 10)
`--delay <n>`	Delay between requests
`--proxy-ip <ip>`	Proxy IP
`--proxy-port <port>`	Proxy port
`--resolve`	Resolve IP addresses
`--add-http-headers <h>`	Add custom headers
`--user-agent <ua>`	Custom user agent
`--prepend-https`	Prepend https:// to input
`--prepend-http`	Prepend http:// to input
`--active-scan`	Active fingerprinting
`--jitter <n>`	Jitter between screenshots

Common Workflows

# Screenshot a subdomain list
cat subs.txt | sed 's/^/http:\/\//' > urls.txt
eyewitness -f urls.txt --web -d report/ --no-prompt

# From nmap scan + report
nmap -sV -p 80,443,8080,8443 -oX scan.xml 192.168.1.0/24
eyewitness -x scan.xml --web -d web_report/ --no-prompt

# With both HTTP and HTTPS
eyewitness -f hosts.txt --prepend-http --prepend-https --web -d out/

# RDP screenshot of internal network
eyewitness -f hosts.txt --rdp -d rdp_report/

Output

EyeWitness produces:

report.html — categorized screenshots with HTTP headers, page titles, response codes
Matches/ — signature-based categories (login pages, Cisco, Citrix, VMware, etc.)
Screenshots/ — raw screenshot images (PNG)
Eyewitness.db — SQLite database with all results

Pipeline Integration

# From subfinder → httpx → eyewitness
subfinder -d target.com -silent | \
  httpx -silent | \
  tee live_hosts.txt | \
  eyewitness --web -f /dev/stdin -d eyewitness_out/ --no-prompt

# From masscan/nmap port scan
masscan -p 80,443,8080,8443,8000,8888 192.168.1.0/24 -oX masscan.xml
eyewitness -x masscan.xml --web -d report/ --no-prompt

# Include non-standard ports (use httpx first)
cat hosts.txt | httpx -ports 80,443,8080,8443,3000,5000,8888 -silent | \
  eyewitness --web -f /dev/stdin -d report/ --no-prompt

Resources

File	When to load
`references/report-tips.md`	HTML report layout, signature categories, pipeline integration, DB queries