Finds subdomains, keeps the ones that answer as websites, and screenshots each (capped at 100).
The report ranks unusual hosts first.
Target
The domain to enumerate and screenshot. Default example.com.
Results
A PDF with a triage grid, inventory, and screenshot gallery.
Also writes report.json.
Overview
A list of two thousand live hosts tells you almost nothing. You cannot tell the
forgotten Grafana from the parked domain, the staging copy of production from the
marketing microsite, or the login page that should not be public from the one that
should. Reading the list top to bottom is how interesting hosts get missed.
Looking at them fixes that. A screenshot shows you what a host is, not merely
that it answered, and the outlier jumps out of a gallery in a way it never does out
of a table. You end with a triage grid ordered so the unusual comes first, a full
inventory, and the technology spread across the surface, which is where an
offensive security engagement actually starts.
Browsers are the slow part, so they run across the fleet rather than one after
another. No API key is needed anywhere in the run.
Pipeline
Read the target domains.
subfinder and amass enumerate subdomains
from passive sources, and their results merge.
httpx probes the merged set and keeps the hosts answering as
web servers, with title, technology, and CDN.
gowitness screenshots each live URL in headless Chrome,
batched across the fleet.
Screenshots, inventory, and technology breakdown collect into one report.
Inputs
Target domain. One apex whose subdomains get enumerated, probed and
rendered. Everything else in the run is derived from it, so there is no host
list to prepare.
Screenshot cap. How many live hosts reach the browser stage, 100 by
default. The cap sits in the URL extraction step so a public run cannot fan out
thousands of browser requests at a target by accident. Raise it when the scope
is yours and you want the whole surface.
Passive source configuration. Optional API keys for subfinder and amass.
The run works without them, and adding them widens the subdomain set rather
than changing what happens downstream.
Outputs
Triage grid. The hosts worth opening first, scored on auth-gated status
codes, unusual titles, and technology outliers. This is the part you read.
Screenshot gallery. One render per live URL, so a forgotten dashboard or
a staging copy of production is recognizable at a glance.
Inventory table. Every host that answered, joined to its title,
technology and CDN from the probe.
Technology landscape. What runs across the surface, which is where a
single odd stack points at something nobody is maintaining.
PDF report. All four in one file, so a run is shareable without handing
anybody access to the platform.
Sample output
From a completed run against example.com.
amass contributes the DNS relationships it can prove:
httpx keeps what answers, and records what is in front of it:
url
port
title
cdn_name
cdn_type
https://www.example.com
443
Example Domain
cloudflare
waf
https://dev.example.com
443
Example Dev
cloudflare
waf
https://staging.example.com
443
Staging
—
—
http://legacy.example.com
80
Index of /
—
—
https://portal.example.com
443
Sign in
cloudflare
waf
Each of those URLs becomes a screenshot in the report. The CDN field is worth
reading too: a host sitting behind a WAF and one answering directly are different
problems.
FAQ
How many hosts get screenshotted?
100 by default. The cap is applied when the live URLs are extracted, before the
browsers start, so a run against a scope you do not control stays proportionate.
Raise it for your own perimeter.
Do you need an API key to run this?
No. Both subdomain sources work from public data as configured. Keys are
optional and only widen the passive set.
Why screenshots rather than a list of titles and status codes?
A title tells you a page responded. A screenshot tells you what it is. A login
form nobody remembers deploying, a default install page, and a staging copy of
production all return 200 with unremarkable titles, and all three are obvious the
moment you look at them.
What decides which hosts appear first?
The report scores each host before laying it out, using auth-gated status codes,
titles that stand out, and technology that differs from the rest of the surface.
The gallery stays complete, but the order does the first pass of triage for you.
Related workflows
Subdomain Enumeration. Reach for
this instead when you need the host list itself, resolved and probed, before
screenshots are worth taking.
Directory & Content Discovery.
Reach for this instead when the screenshots are all default pages and the
interesting content is one path deeper.
Scan WordPress for Known CVEs.
Reach for this instead when the screenshots show WordPress and you want the
plugin and theme CVE picture.