What categories does eyeballer label?

The model sorts each screenshot into four labels: custom404, login, homepage, and oldlooking. Old-looking flags pages that appear to run dated technology, which are often the most worth testing on a large-scope engagement.

How do I feed EyeWitness or gowitness screenshots to eyeballer?

Point the predict input at the folder those tools wrote their captures to. For accurate predictions the screenshots should use a native 1.6x aspect ratio, for example 1440x900, which matches how the model was trained.

Where do I get the model weights?

Supply a weights file with --weights. Pretrained releases are published on the eyeballer GitHub project at github.com/BishopFox/eyeballer, and that file is what the predict step loads.

What does the --threshold flag do?

It sets the confidence cutoff for applying a label. Raise it to keep only high-confidence predictions and cut false positives, or lower it to label more screenshots and widen coverage.

Can eyeballer be retrained on my own data?

Upstream eyeballer ships train and evaluate commands for building your own weights, but the Trickest node exposes the predict path. Point the node at a supplied weights file, or train offline and bring the resulting weights in with --weights.

What does the heatmap show?

With --heatmap, eyeballer renders which regions of a screenshot influenced the model's prediction, which helps you trust or question a given label.

Updated Jul 14, 2026

Machine Learning

Triage website screenshots to find interesting targets

Find interesting targets in a huge set of web-based hosts by labeling screenshots with machine learning.

Triage a massive screenshot set Prioritize targets on a large-scope test Surface old, likely-vulnerable pages

overview

What eyeballer does

eyeballer runs a trained neural network over a folder of website screenshots and predicts which pages a human should look at first. It sorts a huge capture set into the categories that matter on a large-scope test: old-looking pages that suggest dated, likely-vulnerable software, login portals, custom 404s, and plain homepages.

It works on screenshots you already captured, so the workflow is screenshot first with a tool like gowitness or aquatone, then hand that folder to eyeballer. A trained weights file drives the predictions and a confidence threshold controls how aggressively it labels; for best results the captures should use a native 1.6x aspect ratio such as 1440x900.

On Trickest, eyeballer is a Machine Learning node that takes a screenshot folder and writes a folder of predictions. It turns a flat gallery into a ranked, labeled set, and can render a heatmap that shows where the model focused for each call.

source github.com/BishopFox/eyeballer

use cases

Where eyeballer fits

Triage a massive screenshot set

Run the model over thousands of captured pages so the interesting hosts rise to the top instead of being lost among default and parked pages.

Prioritize targets on a large-scope test

Use the labels to decide which web hosts deserve manual review first, focusing limited engagement time on the highest-signal pages.

Surface old, likely-vulnerable pages

Filter for the old-looking label to pull dated technology and legacy portals out of the pile, since those pages tend to carry the software most worth testing.

Tune sensitivity with a threshold

Raise or lower the confidence threshold to trade off how many screenshots get labeled, balancing coverage against false positives.

Explain predictions with a heatmap

Generate a heatmap for a prediction to see which regions of a screenshot drove the model's label, which helps sanity-check the output.

reference

eyeballer inputs and flags

4 inputs

Name	Type	Flag	Description
predict-folder	FOLDER	predict	Folder with screenshots to classify. Best results use a native 1.6x aspect ratio (e.g. 1440x900).
weights	FILE	--weights	Weights file for the model. Trained releases are published on the eyeballer GitHub.
threshold	STRING	--threshold	Confidence threshold for applying a label.
heatmap	BOOLEAN	--heatmap	Create a heatmap graph for the prediction.

Showing key inputs. eyeballer exposes 4 inputs in total.

example

Run eyeballer

eyeballer · command

# rank a folder of captured screenshots, label only high-confidence hitseyeballer predict ./screenshots/ --weights bishopfox.h5 --threshold 0.7 --heatmap

sample output

Loading weights from bishopfox.h5Found 1240 screenshots to predict198.51.100.17.png     login 0.94   oldlooking 0.88   homepage 0.02   custom404 0.00203.0.113.42.png      oldlooking 0.91  login 0.07   homepage 0.11   custom404 0.01app.example.com.png   homepage 0.96   login 0.03   oldlooking 0.05   custom404 0.00198.51.100.9.png      custom404 0.98  login 0.00   homepage 0.01   oldlooking 0.02Wrote heatmaps to output/heatmaps/Summary: 143 oldlooking, 88 login, 512 homepage, 217 custom404

guidance

Choosing eyeballer

Use eyeballer when you already have a large folder of website screenshots and need to rank them by interest. It classifies, it does not capture, so screenshot first with gowitness or aquatone and feed eyeballer that folder.

gowitness

Captures the screenshots eyeballer needs. Run it before eyeballer, not instead of it.

aquatone

Screenshots hosts and builds an HTML gallery. eyeballer adds ML labeling on top of a capture set.

eyewitness

Another screenshot-and-report tool. Pairs with eyeballer as the capture stage.

faq

eyeballer questions

No. It classifies screenshots you already captured, so run gowitness, aquatone, or EyeWitness first and pass eyeballer the resulting folder. On Trickest, wire the capture node's output folder into the eyeballer node.

Run eyeballer yourself

Hosts are screenshotted by gowitness, then eyeballer labels each capture and writes a ranked folder of interesting targets to triage.

Run eyeballer in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Triage website screenshots to find interesting targets

Find interesting targets in a huge set of web-based hosts by labeling screenshots with machine learning.

Name

Type

Flag

Description

predict-folder

FOLDER

predict

Folder with screenshots to classify. Best results use a native 1.6x aspect ratio (e.g. 1440x900).

weights

FILE

--weights

Weights file for the model. Trained releases are published on the eyeballer GitHub.

threshold

STRING

--threshold

Confidence threshold for applying a label.

heatmap

BOOLEAN

--heatmap

Create a heatmap graph for the prediction.

Loading weights from bishopfox.h5Found 1240 screenshots to predict198.51.100.17.png login 0.94 oldlooking 0.88 homepage 0.02 custom404 0.00203.0.113.42.png oldlooking 0.91 login 0.07 homepage 0.11 custom404 0.01app.example.com.png homepage 0.96 login 0.03 oldlooking 0.05 custom404 0.00198.51.100.9.png custom404 0.98 login 0.00 homepage 0.01 oldlooking 0.02Wrote heatmaps to output/heatmaps/Summary: 143 oldlooking, 88 login, 512 homepage, 217 custom404