How does aquatone take screenshots?

It drives a headless Chrome or Chromium instance to render each live URL and writes a PNG per host into the report folder. Set -resolution to change the capture size and -screenshot-timeout to cap how long a slow page can block the run.

What does aquatone produce?

A folder holding an HTML report, per-host screenshots, and saved response bodies, so you can scroll the surface and keep the evidence in one place.

Which ports does aquatone check?

By default 80, 443, 8000, 8080, and 8443. Set -ports to a custom list or an alias (small, medium, large, xlarge) to widen or narrow the scan, and tune -scan-timeout for slow networks.

Can I regenerate a report without rescanning?

Yes. Point -session at a saved session file and aquatone rebuilds the HTML report from the stored data, optionally with a custom -template-path, so you skip the scan and screenshot passes.

aquatone or gowitness for screenshots?

Both screenshot a list of URLs. aquatone bundles the clustered HTML gallery and saved bodies in one folder; gowitness runs a newer headless-Chrome engine and stores results in a queryable database. Pick aquatone when a shareable visual report is the goal.

Updated Jul 15, 2026

Discovery

Screenshot a host list and eyeball its HTTP attack surface

Visual inspection of websites across a large number of hosts.

Triage a large host list by eye Document an engagement's web surface Spot default and parked pages

overview

What aquatone does

aquatone takes a list of URLs, requests each one, and captures a screenshot plus the response, then stitches everything into a single HTML report. Instead of reading thousands of status codes, you scroll a gallery of how each host renders and spot the login panels, default pages, and abandoned apps that deserve a closer look.

It probes a configurable set of ports per host, so a host list resolves into the live web services running on it before the screenshots happen. Timeouts for scanning, HTTP requests, and screenshots keep wide runs from stalling on dead targets, and thread count controls how hard it pushes.

On Trickest, aquatone is a Discovery node that takes a list of URLs and writes a folder holding the report, the screenshots, and saved response bodies. Chain it after subdomain enumeration and a prober so you get a visual triage of everything that answered.

source github.com/michenriksen/aquatone

use cases

Where aquatone fits

Triage a large host list by eye

Feed thousands of resolved hosts and read the screenshot gallery to find login pages, admin panels, and forgotten apps faster than parsing status codes.

Document an engagement's web surface

Generate one HTML report with screenshots and saved bodies so the findings and the visual evidence live in the same artifact for the writeup.

Spot default and parked pages

Scan a wide scope and let the gallery surface stock installer pages, parked domains, and out-of-the-box dashboards that flat text output hides.

Re-render a saved session

Load an existing session file and regenerate the HTML report with a custom template, without re-scanning every host.

reference

aquatone inputs and flags

13 inputs

Name	Type	Flag	Description
list-of-urls	FILE	·	List of URLs to screenshot and report on.
ports	STRING	-ports	Ports to scan on hosts. Aliases small, medium, large, xlarge (default 80,443,8000,8080,8443).
threads	STRING	-threads	Number of concurrent threads (default number of logical CPUs).
resolution-of-screenshot	STRING	-resolution	Screenshot resolution (default 1440,900).
save-body	BOOLEAN	-save-body	Save response bodies to files (default true).
load-session	FILE	-session	Load an Aquatone session file and regenerate the HTML report.
template-path	FILE	-template-path	Path to an HTML template to use for the report.
http-timeout-miliseconds	STRING	-http-timeout	Timeout in milliseconds for HTTP requests (default 3000).

Showing key inputs. aquatone exposes 13 inputs in total.

Full flag reference (13 inputs)

Name	Type	Flag	Description
ports	STRING	-ports	Ports to scan on hosts. Supported list aliases: small, medium, large, xlarge (default "80,443,8000,8080,8443")
proxy	STRING	-proxy	Proxy to use for HTTP requests
silent	BOOLEAN	-silent	Suppress all output except for errors
threads	STRING	-threads	Number of concurrent threads (default number of logical CPUs)
save-body	BOOLEAN	-save-body	Save response bodies to files (default true)
debug-mode	BOOLEAN	-debug	Print debugging information
list-of-urls	FILE	·	List of URLs
load-session	FILE	-session	Load Aquatone session file and generate HTML report
template-path	FILE	-template-path	Path to HTML template to use for report
http-timeout-miliseconds	STRING	-http-timeout	Timeout in miliseconds for HTTP requests (default 3000)
resolution-of-screenshot	STRING	-resolution	Screenshot resolution (default "1440,900")
scan-timeout-miliseconds	STRING	-scan-timeout	Timeout in miliseconds for port scans (default 100)
screenshot-timeout-miliseconds	STRING	-screenshot-timeout	Timeout in miliseconds for screenshots (default 30000)

example

Run aquatone

aquatone · command

# screenshot a list of URLs and generate the HTML reportcat urls.txt | aquatone -ports large -threads 20 -resolution 1440,900 -save-body

sample output

aquatone v1.7.0 started at 2026-07-15T09:14:02Zhttp://example.com/            : 200 OKhttps://app.example.com/       : 200 OKhttps://dev.example.com:8443/  : 401 Unauthorizedhttp://198.51.100.24/          : 302 Foundhttp://203.0.113.10:8080/      : failed (timeout)Calculating page structure similarities... doneGenerating HTML report... doneWrote HTML report to aquatone_report.html

guidance

Choosing aquatone

Reach for aquatone when you need a visual read of a big web surface, not just text. It screenshots and reports, it does not crawl or scan for vulns, so run it after discovery and probing. For modern headless screenshots, gowitness is a close sibling.

gowitness

Headless-Chrome screenshots with a queryable DB. More modern engine, aquatone bundles the HTML gallery report.

eyeballer

Classifies existing screenshots with ML. Pairs with aquatone rather than replacing it.

httpx

Probes hosts for status and tech without screenshots. Run it before aquatone to filter live targets.

faq

aquatone questions

aquatone is a visual recon tool. Give it a list of URLs and it requests each host, captures a screenshot, saves the response body, and clusters everything into one HTML gallery you scroll to read a web attack surface at a glance.

Run aquatone yourself

A host list is probed by httpx, then aquatone screenshots the live hosts and writes an HTML report folder you can scroll for triage.

Run aquatone in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

list-of-urls

FILE

List of URLs to screenshot and report on.

ports

STRING

-ports

Ports to scan on hosts. Aliases small, medium, large, xlarge (default 80,443,8000,8080,8443).

threads

STRING

-threads

Number of concurrent threads (default number of logical CPUs).

resolution-of-screenshot

STRING

-resolution

Screenshot resolution (default 1440,900).

save-body

BOOLEAN

-save-body

Save response bodies to files (default true).

load-session

FILE

-session

Load an Aquatone session file and regenerate the HTML report.

template-path

FILE

-template-path

Path to an HTML template to use for the report.

http-timeout-miliseconds

STRING

-http-timeout

Timeout in milliseconds for HTTP requests (default 3000).

Name

Type

Flag

Description

ports

STRING

-ports

Ports to scan on hosts. Supported list aliases: small, medium, large, xlarge (default "80,443,8000,8080,8443")

proxy

STRING

-proxy

Proxy to use for HTTP requests

silent

BOOLEAN

-silent

Suppress all output except for errors

threads

STRING

-threads

Number of concurrent threads (default number of logical CPUs)

save-body

BOOLEAN

-save-body

Save response bodies to files (default true)

debug-mode

BOOLEAN

-debug

Print debugging information

list-of-urls

FILE

List of URLs

load-session

FILE

-session

Load Aquatone session file and generate HTML report

template-path

FILE

-template-path

Path to HTML template to use for report

http-timeout-miliseconds

STRING

-http-timeout

Timeout in miliseconds for HTTP requests (default 3000)

resolution-of-screenshot

STRING

-resolution

Screenshot resolution (default "1440,900")

scan-timeout-miliseconds

STRING

-scan-timeout

Timeout in miliseconds for port scans (default 100)

screenshot-timeout-miliseconds

STRING

-screenshot-timeout

Timeout in miliseconds for screenshots (default 30000)

aquatone v1.7.0 started at 2026-07-15T09:14:02Zhttp://example.com/ : 200 OKhttps://app.example.com/ : 200 OKhttps://dev.example.com:8443/ : 401 Unauthorizedhttp://198.51.100.24/ : 302 Foundhttp://203.0.113.10:8080/ : failed (timeout)Calculating page structure similarities... doneGenerating HTML report... doneWrote HTML report to aquatone_report.html

Screenshot a host list and eyeball its HTTP attack surface

What aquatone does

Where aquatone fits

Triage a large host list by eye

Document an engagement's web surface

Spot default and parked pages

Re-render a saved session

aquatone inputs and flags

Run aquatone

Choosing aquatone

gowitness

eyeballer

httpx

aquatone questions

More Discovery tools

404checker

anew

apkurlgrep

aws-s3-data-finder

bfac

cariddi

Run aquatone yourself

Screenshot a host list and eyeball its HTTP attack surface

What aquatone does

Where aquatone fits

Triage a large host list by eye

Document an engagement's web surface

Spot default and parked pages

Re-render a saved session

aquatone inputs and flags

Run aquatone

Choosing aquatone

gowitness

eyeballer

httpx

aquatone questions

More Discovery tools

404checker

anew

apkurlgrep

aws-s3-data-finder

bfac

cariddi

Run aquatone yourself