Discovery
Screenshot HTTP services from nmap XML
gowitness-nmap is the nmap-aware mode of SensePost's gowitness that reads an nmap XML scan, selects the http and https services the scan found, and screenshots each one with headless Chrome without a hand-built URL list.
installgo install github.com/sensepost/gowitness@latest
Go · GPL-3.0 license
overview
What gowitness-nmap does
gowitness-nmap takes nmap XML on -f, selects http and https services from the scan, and captures each interface with headless Chrome without a hand-built URL list.
Nmap-aware filters decide the shoot list: --open keeps open ports, --port narrows port numbers, and --service or --service-contains match detected names. Render still uses -t, --timeout, --fullpage, --user-agent, and --proxy.
Run it after a port-scan stage when open ports should become a visual gallery. Odd-port web apps are captured alongside 80 and 443, which helps spot login pages, default panels, and forgotten consoles.
use cases
Where gowitness-nmap fits
Turn a port scan into screenshots
Feed gowitness-nmap an nmap XML file so every web service the scan found gets captured with headless Chrome in a single pass.
Screenshot only the web ports
Filter by open status, port number, or detected service name so the run captures http and https interfaces and skips everything else.
Find web apps on odd ports
Because input comes from nmap, web services on non-standard ports get screenshotted alongside the usual 80 and 443.
Visually triage scan output
Review the gallery to spot login pages, default panels, and exposed consoles among the services a port scan surfaced.
reference
gowitness-nmap inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input-file | FILE | -f | nmap XML file to read discovered services from. |
| open | BOOLEAN | --open | Only select open ports. |
| port | STRING | --port | Filter services by port number. |
| service | STRING | --service | Filter by the service name nmap mapped. |
| service-contains | STRING | --service-contains | Partial service-name filter (contains match). |
| threads | STRING | -t | Threads used to run (default 4). |
| fullpage | BOOLEAN | --fullpage | Take full-page screenshots. |
| proxy | STRING | --proxy | HTTP or SOCKS5 proxy to route requests through. |
Showing key inputs. gowitness-nmap exposes 19 inputs in total.
Full flag reference (19 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| input-file | FILE | -f | nmap XML file to read discovered services from. |
| open | BOOLEAN | --open | Only select open ports. |
| port | STRING | --port | Filter services by port number. |
| service | STRING | --service | Map service-name filter, matching the service nmap detected. |
| service-contains | STRING | --service-contains | Partial service-name filter (contains match). |
| threads | STRING | -t | Threads used to run (default 4). |
| timeout | STRING | --timeout | Preflight check timeout in seconds (default 10). |
| delay | STRING | --delay | Delay in seconds between navigation and screenshot. |
| fullpage | BOOLEAN | --fullpage | Take full-page screenshots. |
| BOOLEAN | Save screenshots as PDF. | ||
| proxy | STRING | --proxy | HTTP or SOCKS5 proxy to use, in proto://address:port format. |
| header | STRING | --header | Additional HTTP header to set on each request. |
| user-agent | STRING | --user-agent | User-agent string to send (defaults to a desktop Chrome UA). |
| x-resolution | STRING | -X | Screenshot resolution width (default 1440). |
| y-resolution | STRING | -Y | Screenshot resolution height (default 900). |
| no-http | BOOLEAN | --no-http | Do not prefix http:// where the scheme is missing. |
| no-https | BOOLEAN | --no-https | Do not prefix https:// where the scheme is missing. |
| debug | BOOLEAN | --debug | Enable debug logging. |
| disable-logging | BOOLEAN | --disable-logging | Disable all logging. |
example
Run gowitness-nmap
# screenshot open web services from an nmap XML scan
gowitness nmap -f scan.xml --open --service http --fullpage -t 8INFO[0000] Reading Nmap XML file file=scan.xml
INFO[0000] Found 5 web service(s) to screenshot
INFO[0001] screenshotting url=http://198.51.100.10:80
INFO[0002] screenshotting url=https://198.51.100.10:443
INFO[0003] screenshotting url=http://198.51.100.23:8080
INFO[0004] screenshotting url=https://203.0.113.45:8443
INFO[0006] screenshotting url=http://example.com:80
INFO[0007] Complete screenshots=5 folder=./screenshotsguidance
Choosing gowitness-nmap
Use gowitness-nmap to screenshot web services straight from nmap XML, with port and service filters. Run after a port scan. For a plain URL list use gowitness; for SQLite output use gowitness-db.
gowitness
Screenshots a plain URL list. gowitness-nmap reads nmap XML and filters by port and service.
gowitness-db
Screenshots a URL list into SQLite. Same engine, different input and output shape.
aquatone
Can consume nmap XML and build an HTML screenshot report for visual triage.
faq
gowitness-nmap questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run gowitness-nmap yourself
An nmap XML file feeds gowitness-nmap, which screenshots the discovered web services and writes the captures as a queryable output.
Facts on this page come from the live Trickest tool library.