Where do the screenshots and database land?

The PNG files write to a screenshots folder and the capture metadata writes to a SQLite database (gowitness.sqlite3). Upstream you can move the image folder with --screenshot-path; the Trickest node collects both the database and the images into its output folder for you.

Can I pipe URLs into gowitness from stdin?

The upstream CLI reads stdin when you pass `-f -`, so `cat urls.txt | gowitness file -f -` works, as does chaining it after httpx. The Trickest node takes a file on its url-list input, so wire the previous node's output file straight in rather than piping.

How is gowitness-db different from gowitness?

Same screenshot engine, but this variant is pinned to write a SQLite database so you query capture metadata instead of browsing a folder of images. Reach for the base gowitness node when you only want the image files.

How do I speed up a large screenshot run?

Raise the worker count with -t (the --threads long form); default is 4, and each worker drives its own Chrome tab, so 8 to 16 clears a big list far faster. Add --timeout to cap slow preflight checks and --delay only where pages need time to finish rendering.

Can gowitness-db screenshot through a proxy?

Yes. Set --proxy with a proto://host:port value, such as `--proxy socks5://198.51.100.10:1080`, to route Chrome through an HTTP or SOCKS5 proxy. Useful for reaching internal hosts or capturing from a fixed egress IP.

What about screenshotting straight from an nmap scan?

Use the gowitness-nmap node, which feeds gowitness an nmap XML file and shoots the discovered web services directly. gowitness-db expects a URL list, so probe with httpx first if all you have is host and port data.

Does it use the new `gowitness scan file` command?

No. This node tracks the gowitness v2 CLI, where you run `gowitness file -f urls.txt` and get a SQLite database by default. The v3 rewrite moved screenshotting under `gowitness scan file` with a database enabled by --write-db; that command and its flags are upstream-only and not exposed on this node.

Updated Jul 14, 2026

Discovery

Screenshot a URL list into a queryable SQLite database

A gowitness variant that screenshots web interfaces and outputs a SQLite database.

Capture a surface into a queryable db Triage live web interfaces at scale Tune how each page renders

overview

What gowitness-db does

gowitness-db is the gowitness screenshot utility set to store its results in a SQLite database. It drives headless Chrome across a URL list, captures each web interface, and records the screenshot path, HTTP status, page title, and response headers as rows instead of leaving you a loose folder of images.

A database changes how you triage. Instead of clicking through hundreds of PNGs, you query the capture metadata to find login portals, default admin panels, and which hosts answered 200 versus 403 across a large surface. The render controls match the base tool: worker count with -t, a --delay for JavaScript-heavy pages, --fullpage capture, custom -X and -Y resolution, a --proxy, and a --user-agent.

On Trickest, gowitness-db is a Discovery node that reads a URL list and writes a folder holding the SQLite database and the screenshots. Run it after subdomain discovery and httpx probing so it only shoots hosts that answer, then query the database to rank which interfaces are worth a closer look.

source github.com/sensepost/gowitness

use cases

Where gowitness-db fits

Capture a surface into a queryable db

Screenshot a URL list and land every capture in SQLite, so you filter by HTTP status or page title instead of clicking through hundreds of images.

Triage live web interfaces at scale

Drive headless Chrome over thousands of hosts to surface login portals, default admin panels, and exposed consoles, then query the database to decide what to open first.

Tune how each page renders

Set --fullpage, a --delay for JavaScript-heavy apps, custom -X and -Y resolution, a --user-agent, and a --proxy so every interface renders the same way before the shutter fires.

Feed downstream reporting

Hand the SQLite database to a reporting or review step so a bulk screenshot run becomes structured data the rest of the pipeline can read and rank.

reference

gowitness-db inputs and flags

15 inputs

Name	Type	Flag	Description
url-list	FILE	-f	file listing the URLs to screenshot
threads	STRING	-t	worker threads used to run (default 4)
delay	STRING	--delay	delay in seconds between navigation and screenshot
fullpage	BOOLEAN	--fullpage	take full-page screenshots
proxy	STRING	--proxy	HTTP or SOCKS5 proxy, in proto://address:port form
user-agent	STRING	--user-agent	user agent string to send with each request
x-resolution	STRING	-X	screenshot width in pixels (default 1440)
pdf	BOOLEAN	--pdf	save each screenshot as a PDF as well

Showing key inputs. gowitness-db exposes 15 inputs in total.

Full flag reference (15 inputs)

Name	Type	Flag	Description
url-list	FILE	-f	file listing the URLs to screenshot
threads	STRING	-t	worker threads used to run (default 4)
timeout	STRING	--timeout	preflight check timeout in seconds (default 10)
delay	STRING	--delay	delay in seconds between navigation and screenshot
fullpage	BOOLEAN	--fullpage	take full-page screenshots
pdf	BOOLEAN	--pdf	save each screenshot as a PDF as well
x-resolution	STRING	-X	screenshot width in pixels (default 1440)
y-resolution	STRING	-Y	screenshot height in pixels (default 900)
proxy	STRING	--proxy	HTTP or SOCKS5 proxy to use, in proto://address:port form
header	STRING	--header	additional HTTP header to set on each request
user-agent	STRING	--user-agent	user agent string to send (default Chrome on macOS)
no-http	BOOLEAN	--no-http	do not prefix http:// where it is missing
no-https	BOOLEAN	--no-https	do not prefix https:// where it is missing
debug	BOOLEAN	--debug	enable debug logging
disable-logging	BOOLEAN	--disable-logging	disable all logging

example

Run gowitness-db

gowitness-db · command

# screenshot a list of live hosts, full-page, 8 workers, into gowitness.sqlite3gowitness file -f live-hosts.txt -t 8 --fullpage --timeout 15 --delay 2

sample output

INFO[0000] starting gowitnessINFO[0000] using sqlite db at gowitness.sqlite3INFO[0001] preflight result   statuscode=200 title="Admin Login" url=https://app.example.comINFO[0001] took screenshot    file=screenshots/https-app.example.com.png url=https://app.example.comINFO[0002] preflight result   statuscode=200 title="Grafana" url=https://grafana.example.comINFO[0002] took screenshot    file=screenshots/https-grafana.example.com.png url=https://grafana.example.comINFO[0003] preflight result   statuscode=401 title="" url=https://vpn.example.comINFO[0004] finished           screenshots=3 db=gowitness.sqlite3

guidance

Choosing gowitness-db

Use gowitness-db when you want screenshot results in a SQLite database you can query, rather than a folder of images. Run it after discovery and probing so it captures only live hosts. For plain screenshot output, use gowitness; to drive it from nmap XML, use gowitness-nmap.

gowitness

The base screenshot tool with flexible writers. gowitness-db pins output to a SQLite database from the start.

gowitness-nmap

Feeds gowitness an nmap XML file so it screenshots discovered web services directly.

aquatone

Screenshots hosts and builds an HTML report. A different way to triage a web surface visually.

faq

gowitness-db questions

Pass a file of URLs with -f, for example `gowitness file -f urls.txt`. It reads each URL, screenshots it with headless Chrome, and writes the captures plus their metadata to a gowitness.sqlite3 database. On Trickest, set the node's url-list input instead of typing the flag.

Run gowitness-db yourself

A URL list is probed by httpx, then gowitness-db screenshots the live interfaces and writes them into a queryable SQLite database.

Run gowitness-db in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url-list

FILE

-f

file listing the URLs to screenshot

threads

STRING

-t

worker threads used to run (default 4)

delay

STRING

--delay

delay in seconds between navigation and screenshot

fullpage

BOOLEAN

--fullpage

take full-page screenshots

proxy

STRING

--proxy

HTTP or SOCKS5 proxy, in proto://address:port form

user-agent

STRING

--user-agent

user agent string to send with each request

x-resolution

STRING

-X

screenshot width in pixels (default 1440)

pdf

BOOLEAN

--pdf

save each screenshot as a PDF as well

Name

Type

Flag

Description

url-list

FILE

-f

file listing the URLs to screenshot

threads

STRING

-t

worker threads used to run (default 4)

timeout

STRING

--timeout

preflight check timeout in seconds (default 10)

delay

STRING

--delay

delay in seconds between navigation and screenshot

fullpage

BOOLEAN

--fullpage

take full-page screenshots

pdf

BOOLEAN

--pdf

save each screenshot as a PDF as well

x-resolution

STRING

-X

screenshot width in pixels (default 1440)

y-resolution

STRING

-Y

screenshot height in pixels (default 900)

proxy

STRING

--proxy

HTTP or SOCKS5 proxy to use, in proto://address:port form

header

STRING

--header

additional HTTP header to set on each request

user-agent

STRING

--user-agent

user agent string to send (default Chrome on macOS)

no-http

BOOLEAN

--no-http

do not prefix http:// where it is missing

no-https

BOOLEAN

--no-https

do not prefix https:// where it is missing

debug

BOOLEAN

--debug

enable debug logging

disable-logging

BOOLEAN

--disable-logging

disable all logging

INFO[0000] starting gowitnessINFO[0000] using sqlite db at gowitness.sqlite3INFO[0001] preflight result statuscode=200 title="Admin Login" url=https://app.example.comINFO[0001] took screenshot file=screenshots/https-app.example.com.png url=https://app.example.comINFO[0002] preflight result statuscode=200 title="Grafana" url=https://grafana.example.comINFO[0002] took screenshot file=screenshots/https-grafana.example.com.png url=https://grafana.example.comINFO[0003] preflight result statuscode=401 title="" url=https://vpn.example.comINFO[0004] finished screenshots=3 db=gowitness.sqlite3

Screenshot a URL list into a queryable SQLite database

What gowitness-db does

Where gowitness-db fits

Capture a surface into a queryable db

Triage live web interfaces at scale

Tune how each page renders

Feed downstream reporting

gowitness-db inputs and flags

Run gowitness-db

Choosing gowitness-db

gowitness

gowitness-nmap

aquatone

gowitness-db questions

More Discovery tools

404checker

anew

apkurlgrep

aquatone

aws-s3-data-finder

bfac

Run gowitness-db yourself

Screenshot a URL list into a queryable SQLite database

What gowitness-db does

Where gowitness-db fits

Capture a surface into a queryable db

Triage live web interfaces at scale

Tune how each page renders

Feed downstream reporting

gowitness-db inputs and flags

Run gowitness-db

Choosing gowitness-db

gowitness

gowitness-nmap

aquatone

gowitness-db questions

More Discovery tools

404checker

anew

apkurlgrep

aquatone

aws-s3-data-finder

bfac

Run gowitness-db yourself