Updated Jul 15, 2026

Discovery

Build an HTML gallery of a live HTTP surface

Visual inspection of websites across many hosts.

Agent

overview

What aquatone does

aquatone requests each URL in a list, captures a screenshot and response, then builds one HTML report. You scroll a gallery instead of reading thousands of status lines to spot login panels, defaults, and abandoned apps.

Set -ports (aliases small through xlarge) to find web services before capture. -threads controls concurrency; -http-timeout, -scan-timeout, and -screenshot-timeout keep wide runs from stalling. -resolution and -save-body shape the evidence folder.

Trickest runs it as a managed Discovery node: URL list in, FOLDER of report, screenshots, and bodies out. Chain after subdomain enum and httpx so only live targets fill the gallery.

source github.com/michenriksen/aquatone

use cases

Where aquatone fits

Triage a large host list by eye

Feed thousands of resolved hosts and read the screenshot gallery to find login pages, admin panels, and forgotten apps faster than parsing status codes.

Document an engagement's web surface

Generate one HTML report with screenshots and saved bodies so the findings and the visual evidence live in the same artifact for the writeup.

Spot default and parked pages

Scan a wide scope and let the gallery surface stock installer pages, parked domains, and out-of-the-box dashboards that flat text output hides.

Re-render a saved session

Load an existing session file and regenerate the HTML report with a custom template, without re-scanning every host.

reference

aquatone inputs and flags

13 inputs
NameTypeFlagDescription
list-of-urlsFILE·List of URLs to screenshot and report on.
portsSTRING-portsPorts to scan on hosts. Aliases small, medium, large, xlarge (default 80,443,8000,8080,8443).
threadsSTRING-threadsNumber of concurrent threads (default number of logical CPUs).
resolution-of-screenshotSTRING-resolutionScreenshot resolution (default 1440,900).
save-bodyBOOLEAN-save-bodySave response bodies to files (default true).
load-sessionFILE-sessionLoad an Aquatone session file and regenerate the HTML report.
template-pathFILE-template-pathPath to an HTML template to use for the report.
http-timeout-milisecondsSTRING-http-timeoutTimeout in milliseconds for HTTP requests (default 3000).

Showing key inputs. aquatone exposes 13 inputs in total.

Full flag reference (13 inputs)
NameTypeFlagDescription
portsSTRING-portsPorts to scan on hosts. Supported list aliases: small, medium, large, xlarge (default "80,443,8000,8080,8443")
proxySTRING-proxyProxy to use for HTTP requests
silentBOOLEAN-silentSuppress all output except for errors
threadsSTRING-threadsNumber of concurrent threads (default number of logical CPUs)
save-bodyBOOLEAN-save-bodySave response bodies to files (default true)
debug-modeBOOLEAN-debugPrint debugging information
list-of-urlsFILE·List of URLs
load-sessionFILE-sessionLoad Aquatone session file and generate HTML report
template-pathFILE-template-pathPath to HTML template to use for report
http-timeout-milisecondsSTRING-http-timeoutTimeout in miliseconds for HTTP requests (default 3000)
resolution-of-screenshotSTRING-resolutionScreenshot resolution (default "1440,900")
scan-timeout-milisecondsSTRING-scan-timeoutTimeout in miliseconds for port scans (default 100)
screenshot-timeout-milisecondsSTRING-screenshot-timeoutTimeout in miliseconds for screenshots (default 30000)

example

Run aquatone

aquatone · command
# screenshot a list of URLs and generate the HTML reportcat urls.txt | aquatone -ports large -threads 20 -resolution 1440,900 -save-body
sample output
aquatone v1.7.0 started at 2026-07-15T09:14:02Zhttp://example.com/            : 200 OKhttps://app.example.com/       : 200 OKhttps://dev.example.com:8443/  : 401 Unauthorizedhttp://198.51.100.24/          : 302 Foundhttp://203.0.113.10:8080/      : failed (timeout)Calculating page structure similarities... doneGenerating HTML report... doneWrote HTML report to aquatone_report.html

guidance

Choosing aquatone

Use when you need a visual read of a large web surface, not just text. It screenshots and reports; it does not crawl or scan for vulns. Run after discovery and probing. For a newer headless engine with a queryable DB, try gowitness.

gowitness

Headless-Chrome screenshots with a queryable DB. Newer engine; aquatone ships the clustered HTML gallery.

eyeballer

Classifies existing screenshots with ML. Pairs with aquatone rather than replacing it.

httpx

Probes hosts for status and tech without screenshots. Run before aquatone to filter live targets.

faq

aquatone questions

It drives headless Chrome or Chromium to render each live URL and writes a PNG per host into the report folder. Set -resolution for capture size and -screenshot-timeout to cap slow pages.

Run aquatone yourself

A host list is probed by httpx, then aquatone screenshots the live hosts and writes an HTML report folder you can scroll for triage.

Facts on this page come from the live Trickest tool library.