What labels does the model apply?

custom404, login, homepage, and oldlooking. Oldlooking marks dated-looking pages that often deserve manual review first.

Where do model weights come from?

Supply a weights FILE with --weights. Pretrained releases are published on the upstream eyeballer GitHub project.

What does --threshold change?

The confidence cutoff for applying a label. Raise it to cut false positives. Lower it to label more screenshots.

When should I enable --heatmap?

When you need to see which regions of a screenshot influenced a prediction, so you can trust or question a given label.

How does eyeballer differ from gowitness?

gowitness captures pages. eyeballer ranks an existing capture folder with ML labels. They chain: capture, then classify.

Updated Jul 14, 2026

Machine Learning

Rank website screenshots with ML labels

Label website screenshots so interesting hosts surface first.

Triage a massive screenshot set Prioritize targets on a large-scope test Surface old, likely-vulnerable pages

overview

What eyeballer does

eyeballer classifies a folder of website screenshots with a trained neural network. Labels include login, homepage, custom404, and oldlooking so large capture sets become triageable.

Operators run predict against captures from gowitness or aquatone, load --weights, and tune --threshold. Optional --heatmap shows which regions drove each label. Best captures use a native 1.6x ratio such as 1440x900.

Trickest runs eyeballer as a managed Machine Learning node: screenshot folder in, prediction folder out. It ranks pages. It does not capture them.

source github.com/BishopFox/eyeballer

use cases

Where eyeballer fits

Triage a massive screenshot set

Run the model over thousands of captured pages so the interesting hosts rise to the top instead of being lost among default and parked pages.

Prioritize targets on a large-scope test

Use the labels to decide which web hosts deserve manual review first, focusing limited engagement time on the highest-signal pages.

Surface old, likely-vulnerable pages

Filter for the old-looking label to pull dated technology and legacy portals out of the pile, since those pages tend to carry the software most worth testing.

Tune sensitivity with a threshold

Raise or lower the confidence threshold to trade off how many screenshots get labeled, balancing coverage against false positives.

Explain predictions with a heatmap

Generate a heatmap for a prediction to see which regions of a screenshot drove the model's label, which helps sanity-check the output.

reference

eyeballer inputs and flags

4 inputs

Name	Type	Flag	Description
predict-folder	FOLDER	predict	Folder with screenshots to classify. Best results use a native 1.6x aspect ratio (e.g. 1440x900).
weights	FILE	--weights	Weights file for the model. Trained releases are published on the eyeballer GitHub.
threshold	STRING	--threshold	Confidence threshold for applying a label.
heatmap	BOOLEAN	--heatmap	Create a heatmap graph for the prediction.

Showing key inputs. eyeballer exposes 4 inputs in total.

example

Run eyeballer

eyeballer · command

# rank a folder of captured screenshots, label only high-confidence hitseyeballer predict ./screenshots/ --weights bishopfox.h5 --threshold 0.7 --heatmap

sample output

Loading weights from bishopfox.h5Found 1240 screenshots to predict198.51.100.17.png     login 0.94   oldlooking 0.88   homepage 0.02   custom404 0.00203.0.113.42.png      oldlooking 0.91  login 0.07   homepage 0.11   custom404 0.01app.example.com.png   homepage 0.96   login 0.03   oldlooking 0.05   custom404 0.00198.51.100.9.png      custom404 0.98  login 0.00   homepage 0.01   oldlooking 0.02Wrote heatmaps to output/heatmaps/Summary: 143 oldlooking, 88 login, 512 homepage, 217 custom404

guidance

Choosing eyeballer

Use eyeballer after you already have a large screenshot folder and need ML labels to prioritize review. Capture first with gowitness, aquatone, or EyeWitness. eyeballer classifies; it does not screenshot.

gowitness

Captures the screenshots eyeballer needs. Run it before eyeballer, not instead of it.

aquatone

Screenshots hosts and builds an HTML gallery. eyeballer adds ML labels on top of a capture set.

eyewitness

Screenshot-and-report capture tool. Pair it as the stage before eyeballer.

faq

eyeballer questions

No. It classifies screenshots you already captured. Run gowitness, aquatone, or EyeWitness first, then pass that folder to predict.

Run eyeballer yourself

Hosts are screenshotted by gowitness, then eyeballer labels each capture and writes a ranked folder of interesting targets to triage.

Open eyeballer in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.