By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

Active Reconnaissance: Visual Web Reconnaissance

Visual reconnaissance is the process of screenshotting live web targets at scale so you can quickly spot login panels, admin portals, staging systems, default installs, exposed dashboards, and odd applications that deserve manual review.

This lesson used to focus on Aquatone. Aquatone was a strong tool for its time, but the project is now archived and should be treated as legacy tooling. The workflow is still valuable; the modern lesson is to combine subdomain discovery, live HTTP probing, screenshots, technology detection, and human triage.

What You'll Learn

  • Why visual recon is useful after subdomain enumeration
  • How to build a current screenshot workflow
  • Where Aquatone still fits as legacy context
  • How to use modern alternatives such as gowitness and EyeWitness
  • How to triage screenshots without wasting time
  • Defensive controls that reduce accidental exposure

Why Visual Recon Matters

Subdomain enumeration can leave you with hundreds or thousands of hostnames. Most will be ordinary: marketing pages, redirects, dead services, or identical platform defaults. Screenshots let you scan the estate visually and prioritise the targets that look unusual.

Look for:

  • Authentication pages and admin panels
  • Dev, test, staging, preview, and QA environments
  • Default Apache, nginx, IIS, Tomcat, Jenkins, or cloud service pages
  • Error pages leaking stack traces, paths, hostnames, or framework details
  • Internal dashboards accidentally reachable from the internet
  • Old CMS installs, forgotten microsites, or shadow IT applications

Visual recon does not prove a vulnerability by itself. It helps you decide where to spend manual testing time.

A Modern Workflow

Step 1: Enumerate Subdomains

Use more than one source where you are authorised to do so:

subfinder -d example.com -silent -o subfinder.txt
amass enum -passive -d example.com -o amass.txt

curl -s "https://crt.sh/?q=%25.example.com&output=json" \
  | jq -r '.[].name_value' \
  | sed 's/\*\.//g' \
  | sort -u > crtsh.txt

cat subfinder.txt amass.txt crtsh.txt | sort -u > subdomains.txt

Step 2: Find Live Web Services

ProjectDiscovery's httpx is a practical replacement for older httprobe-style workflows because it can probe schemes, titles, status codes, technologies, and response metadata in one pass.

httpx -l subdomains.txt \
  -ports 80,443,8080,8443,3000,5000,8000,9000 \
  -title -status-code -tech-detect -follow-redirects \
  -o live-web.txt

For screenshot tools that expect plain URLs, produce a URL-only list:

httpx -l subdomains.txt -silent -o urls.txt

Step 3: Capture Screenshots

Gowitness

go install github.com/sensepost/gowitness@latest

gowitness scan file -f urls.txt --screenshot-path screenshots
gowitness report serve

Use gowitness when you want a maintained Go-based tool with a local report and simple command-line workflows.

EyeWitness

git clone https://github.com/FortyNorthSecurity/EyeWitness.git
cd EyeWitness/Python/setup
./setup.sh

cd ..
./EyeWitness.py -f urls.txt --web

Use EyeWitness when you want richer reporting, headers, default credential checks, and a tool that many internal assessment teams already know.

Step 4: Triage the Results

Work in passes:

  1. Remove noise: parked pages, obvious redirects, 404 templates, and repeated defaults.
  2. Mark authentication: admin panels, SSO screens, VPN portals, CMS logins, CI/CD tools, and dashboards.
  3. Mark environment clues: dev, test, stage, qa, preview, old, backup, and tenant-specific hostnames.
  4. Follow up manually: browse the target, capture evidence, identify technologies, and test only within scope.

Useful follow-up commands:

# Check titles and status codes again
httpx -l urls.txt -title -status-code -tech-detect

# Scan interesting web ports
nmap -sV -p 80,443,8080,8443,3000,5000,8000,9000 -iL hosts.txt

# Check one target with Nikto
nikto -h https://admin.example.com

Where Aquatone Fits Now

Aquatone popularised this style of visual review and may still appear in older write-ups, scripts, and training material. That does not make it the best default choice today.

Treat Aquatone as:

  • Useful historical context
  • A tool you may meet in older engagement notes
  • Something to avoid building new automation around unless you accept the maintenance risk

If an existing client workflow still uses it, record the version, verify the binary source, and avoid assuming active maintenance.

Example: Bug Bounty Recon

DOMAIN="example.com"

subfinder -d "$DOMAIN" -silent -o subs.txt
httpx -l subs.txt -silent -o urls.txt
gowitness scan file -f urls.txt --screenshot-path "screenshots-$DOMAIN"
gowitness report serve

Prioritise:

  • Admin or staff-only applications
  • Staging systems with weak access controls
  • Old CMS or framework versions
  • Services exposing build names, stack traces, internal hostnames, or debug data
  • Anything that appears out of scope or sensitive, which should be handled carefully and reported according to the program rules

Example: Internal Assessment

nmap -p 80,443,8080,8443,3000,5000,8000,9000 10.0.0.0/24 -oG web.gnmap

awk '/open/ {print $2}' web.gnmap | sort -u > web-hosts.txt

httpx -l web-hosts.txt -silent -ports 80,443,8080,8443,3000,5000,8000,9000 -o internal-urls.txt
gowitness scan file -f internal-urls.txt --screenshot-path internal-screenshots
gowitness report serve

Internal visual recon often finds management consoles, printers, NAS appliances, hypervisors, old wiki systems, and forgotten line-of-business apps. These findings are only useful when they feed into risk-based follow-up, not when they become a screenshot collection with no owner.

Defensive Measures

Reduce what screenshot tools can see:

  • Put internal applications behind VPN, SSO, zero-trust access, or private networking
  • Remove default web server pages after deployment
  • Disable directory listing
  • Require authentication for admin and monitoring interfaces
  • Rate-limit suspicious bursts of requests
  • Log unusual user agents and high-volume screenshot behaviour
  • Keep asset inventory aligned with DNS and cloud accounts

Screenshot tools are not magic. They mostly reveal exposure that already exists.

Quick Reference

# Discover subdomains
subfinder -d example.com -silent -o subs.txt

# Probe live HTTP services
httpx -l subs.txt -silent -title -status-code -tech-detect -o live-web.txt

# Produce URL-only list
httpx -l subs.txt -silent -o urls.txt

# Screenshot with gowitness
gowitness scan file -f urls.txt --screenshot-path screenshots
gowitness report serve

# Screenshot with EyeWitness
./EyeWitness.py -f urls.txt --web

Resources

Next Steps

  1. Build a small authorised target list
  2. Probe for live HTTP services
  3. Capture screenshots with a maintained tool
  4. Triage visually before running noisy scanners
  5. Feed confirmed targets into manual testing

Visual recon is about prioritisation. The screenshot is only the starting point; the value comes from knowing what deserves a closer look.