aeondave/eyewitness

EyeWitness

Screenshots web services and produces an HTML report with categorized results.

Quick Start

# Screenshot from URL list
eyewitness -f urls.txt --web

# Screenshot from nmap XML
eyewitness -x nmap_scan.xml --web

# Specify output directory
eyewitness -f urls.txt --web -d output/eyewitness

Core Flags

| Flag | Description | |------|-------------| | -f <file> | Input file with URLs/hosts | | -x <xml> | Nmap XML output file | | --web | HTTP screenshotting (default) | | --rdp | RDP screenshots | | --vnc | VNC screenshots | | -d <dir> | Output directory | | --no-prompt | Skip interactive prompts | | --timeout <n> | Per-target timeout (default 7s) | | --threads <n> | Threads (default 10) | | --delay <n> | Delay between requests | | --proxy-ip <ip> | Proxy IP | | --proxy-port <port> | Proxy port | | --resolve | Resolve IP addresses | | --add-http-headers <h> | Add custom headers | | --user-agent <ua> | Custom user agent | | --prepend-https | Prepend https:// to input | | --prepend-http | Prepend http:// to input | | --active-scan | Active fingerprinting | | --jitter <n> | Jitter between screenshots |

Common Workflows

# Screenshot a subdomain list
cat subs.txt | sed 's/^/http:\/\//' > urls.txt
eyewitness -f urls.txt --web -d report/ --no-prompt

# From nmap scan + report
nmap -sV -p 80,443,8080,8443 -oX scan.xml 192.168.1.0/24
eyewitness -x scan.xml --web -d web_report/ --no-prompt

# With both HTTP and HTTPS
eyewitness -f hosts.txt --prepend-http --prepend-https --web -d out/

# RDP screenshot of internal network
eyewitness -f hosts.txt --rdp -d rdp_report/

Output

EyeWitness produces:

• report.html — categorized screenshots with HTTP headers, page titles, response codes
• Matches/ — signature-based categories (login pages, Cisco, Citrix, VMware, etc.)
• Screenshots/ — raw screenshot images (PNG)
• Eyewitness.db — SQLite database with all results

Pipeline Integration

# From subfinder → httpx → eyewitness
subfinder -d target.com -silent | \
  httpx -silent | \
  tee live_hosts.txt | \
  eyewitness --web -f /dev/stdin -d eyewitness_out/ --no-prompt

# From masscan/nmap port scan
masscan -p 80,443,8080,8443,8000,8888 192.168.1.0/24 -oX masscan.xml
eyewitness -x masscan.xml --web -d report/ --no-prompt

# Include non-standard ports (use httpx first)
cat hosts.txt | httpx -ports 80,443,8080,8443,3000,5000,8888 -silent | \
  eyewitness --web -f /dev/stdin -d report/ --no-prompt

Resources

| File | When to load | |------|--------------| | references/report-tips.md | HTML report layout, signature categories, pipeline integration, DB queries |