Discovery
Build an HTML gallery of a live HTTP surface
Visual inspection of websites across many hosts.
overview
What aquatone does
aquatone requests each URL in a list, captures a screenshot and response, then builds one HTML report. You scroll a gallery instead of reading thousands of status lines to spot login panels, defaults, and abandoned apps.
Set -ports (aliases small through xlarge) to find web services before capture. -threads controls concurrency; -http-timeout, -scan-timeout, and -screenshot-timeout keep wide runs from stalling. -resolution and -save-body shape the evidence folder.
Trickest runs it as a managed Discovery node: URL list in, FOLDER of report, screenshots, and bodies out. Chain after subdomain enum and httpx so only live targets fill the gallery.
use cases
Where aquatone fits
Triage a large host list by eye
Feed thousands of resolved hosts and read the screenshot gallery to find login pages, admin panels, and forgotten apps faster than parsing status codes.
Document an engagement's web surface
Generate one HTML report with screenshots and saved bodies so the findings and the visual evidence live in the same artifact for the writeup.
Spot default and parked pages
Scan a wide scope and let the gallery surface stock installer pages, parked domains, and out-of-the-box dashboards that flat text output hides.
Re-render a saved session
Load an existing session file and regenerate the HTML report with a custom template, without re-scanning every host.
reference
aquatone inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| list-of-urls | FILE | · | List of URLs to screenshot and report on. |
| ports | STRING | -ports | Ports to scan on hosts. Aliases small, medium, large, xlarge (default 80,443,8000,8080,8443). |
| threads | STRING | -threads | Number of concurrent threads (default number of logical CPUs). |
| resolution-of-screenshot | STRING | -resolution | Screenshot resolution (default 1440,900). |
| save-body | BOOLEAN | -save-body | Save response bodies to files (default true). |
| load-session | FILE | -session | Load an Aquatone session file and regenerate the HTML report. |
| template-path | FILE | -template-path | Path to an HTML template to use for the report. |
| http-timeout-miliseconds | STRING | -http-timeout | Timeout in milliseconds for HTTP requests (default 3000). |
Showing key inputs. aquatone exposes 13 inputs in total.
Full flag reference (13 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| ports | STRING | -ports | Ports to scan on hosts. Supported list aliases: small, medium, large, xlarge (default "80,443,8000,8080,8443") |
| proxy | STRING | -proxy | Proxy to use for HTTP requests |
| silent | BOOLEAN | -silent | Suppress all output except for errors |
| threads | STRING | -threads | Number of concurrent threads (default number of logical CPUs) |
| save-body | BOOLEAN | -save-body | Save response bodies to files (default true) |
| debug-mode | BOOLEAN | -debug | Print debugging information |
| list-of-urls | FILE | · | List of URLs |
| load-session | FILE | -session | Load Aquatone session file and generate HTML report |
| template-path | FILE | -template-path | Path to HTML template to use for report |
| http-timeout-miliseconds | STRING | -http-timeout | Timeout in miliseconds for HTTP requests (default 3000) |
| resolution-of-screenshot | STRING | -resolution | Screenshot resolution (default "1440,900") |
| scan-timeout-miliseconds | STRING | -scan-timeout | Timeout in miliseconds for port scans (default 100) |
| screenshot-timeout-miliseconds | STRING | -screenshot-timeout | Timeout in miliseconds for screenshots (default 30000) |
example
Run aquatone
# screenshot a list of URLs and generate the HTML reportcat urls.txt | aquatone -ports large -threads 20 -resolution 1440,900 -save-bodyaquatone v1.7.0 started at 2026-07-15T09:14:02Zhttp://example.com/ : 200 OKhttps://app.example.com/ : 200 OKhttps://dev.example.com:8443/ : 401 Unauthorizedhttp://198.51.100.24/ : 302 Foundhttp://203.0.113.10:8080/ : failed (timeout)Calculating page structure similarities... doneGenerating HTML report... doneWrote HTML report to aquatone_report.htmlguidance
Choosing aquatone
Use when you need a visual read of a large web surface, not just text. It screenshots and reports; it does not crawl or scan for vulns. Run after discovery and probing. For a newer headless engine with a queryable DB, try gowitness.
gowitness
Headless-Chrome screenshots with a queryable DB. Newer engine; aquatone ships the clustered HTML gallery.
eyeballer
Classifies existing screenshots with ML. Pairs with aquatone rather than replacing it.
httpx
Probes hosts for status and tech without screenshots. Run before aquatone to filter live targets.
faq
aquatone questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run aquatone yourself
A host list is probed by httpx, then aquatone screenshots the live hosts and writes an HTML report folder you can scroll for triage.
Facts on this page come from the live Trickest tool library.