loading
Loading content
loading
Discovery
Visual inspection of websites across many hosts.
overview
aquatone requests each URL in a list, captures a screenshot and response, then builds one HTML report. You scroll a gallery instead of reading thousands of status lines to spot login panels, defaults, and abandoned apps.
Set -ports (aliases small through xlarge) to find web services before capture. -threads controls concurrency; -http-timeout, -scan-timeout, and -screenshot-timeout keep wide runs from stalling. -resolution and -save-body shape the evidence folder.
Trickest runs it as a managed Discovery node: URL list in, FOLDER of report, screenshots, and bodies out. Chain after subdomain enum and httpx so only live targets fill the gallery.
use cases
Feed thousands of resolved hosts and read the screenshot gallery to find login pages, admin panels, and forgotten apps faster than parsing status codes.
Generate one HTML report with screenshots and saved bodies so the findings and the visual evidence live in the same artifact for the writeup.
Scan a wide scope and let the gallery surface stock installer pages, parked domains, and out-of-the-box dashboards that flat text output hides.
Load an existing session file and regenerate the HTML report with a custom template, without re-scanning every host.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| list-of-urls | FILE | · | List of URLs to screenshot and report on. |
| ports | STRING | -ports | Ports to scan on hosts. Aliases small, medium, large, xlarge (default 80,443,8000,8080,8443). |
| threads | STRING | -threads | Number of concurrent threads (default number of logical CPUs). |
| resolution-of-screenshot | STRING | -resolution | Screenshot resolution (default 1440,900). |
| save-body | BOOLEAN | -save-body | Save response bodies to files (default true). |
| load-session | FILE | -session | Load an Aquatone session file and regenerate the HTML report. |
| template-path | FILE | -template-path | Path to an HTML template to use for the report. |
| http-timeout-miliseconds | STRING | -http-timeout | Timeout in milliseconds for HTTP requests (default 3000). |
Showing key inputs. aquatone exposes 13 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| ports | STRING | -ports | Ports to scan on hosts. Supported list aliases: small, medium, large, xlarge (default "80,443,8000,8080,8443") |
| proxy | STRING | -proxy | Proxy to use for HTTP requests |
| silent | BOOLEAN | -silent | Suppress all output except for errors |
| threads | STRING | -threads | Number of concurrent threads (default number of logical CPUs) |
| save-body | BOOLEAN | -save-body | Save response bodies to files (default true) |
| debug-mode | BOOLEAN | -debug | Print debugging information |
| list-of-urls | FILE | · | List of URLs |
| load-session | FILE | -session | Load Aquatone session file and generate HTML report |
| template-path | FILE | -template-path | Path to HTML template to use for report |
| http-timeout-miliseconds | STRING | -http-timeout | Timeout in miliseconds for HTTP requests (default 3000) |
| resolution-of-screenshot | STRING | -resolution | Screenshot resolution (default "1440,900") |
| scan-timeout-miliseconds | STRING | -scan-timeout | Timeout in miliseconds for port scans (default 100) |
| screenshot-timeout-miliseconds | STRING | -screenshot-timeout | Timeout in miliseconds for screenshots (default 30000) |
example
# screenshot a list of URLs and generate the HTML reportcat urls.txt | aquatone -ports large -threads 20 -resolution 1440,900 -save-bodyaquatone v1.7.0 started at 2026-07-15T09:14:02Zhttp://example.com/ : 200 OKhttps://app.example.com/ : 200 OKhttps://dev.example.com:8443/ : 401 Unauthorizedhttp://198.51.100.24/ : 302 Foundhttp://203.0.113.10:8080/ : failed (timeout)Calculating page structure similarities... doneGenerating HTML report... doneWrote HTML report to aquatone_report.htmlguidance
Use when you need a visual read of a large web surface, not just text. It screenshots and reports; it does not crawl or scan for vulns. Run after discovery and probing. For a newer headless engine with a queryable DB, try gowitness.
Headless-Chrome screenshots with a queryable DB. Newer engine; aquatone ships the clustered HTML gallery.
Classifies existing screenshots with ML. Pairs with aquatone rather than replacing it.
Probes hosts for status and tech without screenshots. Run before aquatone to filter live targets.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A host list is probed by httpx, then aquatone screenshots the live hosts and writes an HTML report folder you can scroll for triage.
Facts on this page come from the live Trickest tool library.