Discovery
Query screenshot captures from a URL list
Screenshot URLs and store capture metadata in SQLite.
overview
What gowitness-db does
gowitness-db drives headless Chrome over a URL list and records screenshot path, HTTP status, page title, and headers as SQLite rows instead of a loose image folder.
Use it when triage needs queries: filter login portals, default panels, and 200 vs 403 hosts without clicking through PNGs. Render controls include -t, --delay, --fullpage, -X/-Y, --proxy, and --user-agent.
Trickest provides it as a managed Discovery node. Wire a live URL list after httpx, collect the SQLite database and screenshots from the output folder, then query before deeper review.
use cases
Where gowitness-db fits
Capture a surface into a queryable db
Screenshot a URL list and land every capture in SQLite, so you filter by HTTP status or page title instead of clicking through hundreds of images.
Triage live web interfaces at scale
Drive headless Chrome over thousands of hosts to surface login portals, default admin panels, and exposed consoles, then query the database to decide what to open first.
Tune how each page renders
Set --fullpage, a --delay for JavaScript-heavy apps, custom -X and -Y resolution, a --user-agent, and a --proxy so every interface renders the same way before the shutter fires.
Feed downstream reporting
Hand the SQLite database to a reporting or review step so a bulk screenshot run becomes structured data the rest of the pipeline can read and rank.
reference
gowitness-db inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url-list | FILE | -f | file listing the URLs to screenshot |
| threads | STRING | -t | worker threads used to run (default 4) |
| delay | STRING | --delay | delay in seconds between navigation and screenshot |
| fullpage | BOOLEAN | --fullpage | take full-page screenshots |
| proxy | STRING | --proxy | HTTP or SOCKS5 proxy, in proto://address:port form |
| user-agent | STRING | --user-agent | user agent string to send with each request |
| x-resolution | STRING | -X | screenshot width in pixels (default 1440) |
| BOOLEAN | save each screenshot as a PDF as well |
Showing key inputs. gowitness-db exposes 15 inputs in total.
Full flag reference (15 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url-list | FILE | -f | file listing the URLs to screenshot |
| threads | STRING | -t | worker threads used to run (default 4) |
| timeout | STRING | --timeout | preflight check timeout in seconds (default 10) |
| delay | STRING | --delay | delay in seconds between navigation and screenshot |
| fullpage | BOOLEAN | --fullpage | take full-page screenshots |
| BOOLEAN | save each screenshot as a PDF as well | ||
| x-resolution | STRING | -X | screenshot width in pixels (default 1440) |
| y-resolution | STRING | -Y | screenshot height in pixels (default 900) |
| proxy | STRING | --proxy | HTTP or SOCKS5 proxy to use, in proto://address:port form |
| header | STRING | --header | additional HTTP header to set on each request |
| user-agent | STRING | --user-agent | user agent string to send (default Chrome on macOS) |
| no-http | BOOLEAN | --no-http | do not prefix http:// where it is missing |
| no-https | BOOLEAN | --no-https | do not prefix https:// where it is missing |
| debug | BOOLEAN | --debug | enable debug logging |
| disable-logging | BOOLEAN | --disable-logging | disable all logging |
example
Run gowitness-db
# screenshot a list of live hosts, full-page, 8 workers, into gowitness.sqlite3gowitness file -f live-hosts.txt -t 8 --fullpage --timeout 15 --delay 2INFO[0000] starting gowitnessINFO[0000] using sqlite db at gowitness.sqlite3INFO[0001] preflight result statuscode=200 title="Admin Login" url=https://app.example.comINFO[0001] took screenshot file=screenshots/https-app.example.com.png url=https://app.example.comINFO[0002] preflight result statuscode=200 title="Grafana" url=https://grafana.example.comINFO[0002] took screenshot file=screenshots/https-grafana.example.com.png url=https://grafana.example.comINFO[0003] preflight result statuscode=401 title="" url=https://vpn.example.comINFO[0004] finished screenshots=3 db=gowitness.sqlite3guidance
Choosing gowitness-db
Use gowitness-db when screenshot results need a queryable SQLite database rather than a folder of images. Run after discovery and probing so only live hosts are captured. For image-only output use gowitness; for nmap XML input use gowitness-nmap.
gowitness
Base screenshot tool with flexible writers. gowitness-db pins output to SQLite from the start.
gowitness-nmap
Feeds gowitness an nmap XML file and screenshots discovered web services directly.
aquatone
Screenshots hosts and builds an HTML report. Another path for visual triage of a web surface.
faq
gowitness-db questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run gowitness-db yourself
A URL list is probed by httpx, then gowitness-db screenshots the live interfaces and writes them into a queryable SQLite database.
Facts on this page come from the live Trickest tool library.