loading
Loading content
loading
Discovery
Screenshot web services discovered in an nmap XML scan.
overview
gowitness-nmap takes nmap XML on -f, selects http and https services from the scan, and captures each interface with headless Chrome without a hand-built URL list.
Nmap-aware filters decide the shoot list: --open keeps open ports, --port narrows port numbers, and --service or --service-contains match detected names. Render still uses -t, --timeout, --fullpage, --user-agent, and --proxy.
Run it after a port-scan stage when open ports should become a visual gallery. Odd-port web apps are captured alongside 80 and 443, which helps spot login pages, default panels, and forgotten consoles.
use cases
Feed gowitness-nmap an nmap XML file so every web service the scan found gets captured with headless Chrome in a single pass.
Filter by open status, port number, or detected service name so the run captures http and https interfaces and skips everything else.
Because input comes from nmap, web services on non-standard ports get screenshotted alongside the usual 80 and 443.
Review the gallery to spot login pages, default panels, and exposed consoles among the services a port scan surfaced.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input-file | FILE | -f | nmap XML file to read discovered services from. |
| open | BOOLEAN | --open | Only select open ports. |
| port | STRING | --port | Filter services by port number. |
| service | STRING | --service | Filter by the service name nmap mapped. |
| service-contains | STRING | --service-contains | Partial service-name filter (contains match). |
| threads | STRING | -t | Threads used to run (default 4). |
| fullpage | BOOLEAN | --fullpage | Take full-page screenshots. |
| proxy | STRING | --proxy | HTTP or SOCKS5 proxy to route requests through. |
Showing key inputs. gowitness-nmap exposes 19 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| input-file | FILE | -f | nmap XML file to read discovered services from. |
| open | BOOLEAN | --open | Only select open ports. |
| port | STRING | --port | Filter services by port number. |
| service | STRING | --service | Map service-name filter, matching the service nmap detected. |
| service-contains | STRING | --service-contains | Partial service-name filter (contains match). |
| threads | STRING | -t | Threads used to run (default 4). |
| timeout | STRING | --timeout | Preflight check timeout in seconds (default 10). |
| delay | STRING | --delay | Delay in seconds between navigation and screenshot. |
| fullpage | BOOLEAN | --fullpage | Take full-page screenshots. |
| BOOLEAN | Save screenshots as PDF. | ||
| proxy | STRING | --proxy | HTTP or SOCKS5 proxy to use, in proto://address:port format. |
| header | STRING | --header | Additional HTTP header to set on each request. |
| user-agent | STRING | --user-agent | User-agent string to send (defaults to a desktop Chrome UA). |
| x-resolution | STRING | -X | Screenshot resolution width (default 1440). |
| y-resolution | STRING | -Y | Screenshot resolution height (default 900). |
| no-http | BOOLEAN | --no-http | Do not prefix http:// where the scheme is missing. |
| no-https | BOOLEAN | --no-https | Do not prefix https:// where the scheme is missing. |
| debug | BOOLEAN | --debug | Enable debug logging. |
| disable-logging | BOOLEAN | --disable-logging | Disable all logging. |
example
# screenshot open web services from an nmap XML scangowitness nmap -f scan.xml --open --service http --fullpage -t 8INFO[0000] Reading Nmap XML file file=scan.xmlINFO[0000] Found 5 web service(s) to screenshotINFO[0001] screenshotting url=http://198.51.100.10:80INFO[0002] screenshotting url=https://198.51.100.10:443INFO[0003] screenshotting url=http://198.51.100.23:8080INFO[0004] screenshotting url=https://203.0.113.45:8443INFO[0006] screenshotting url=http://example.com:80INFO[0007] Complete screenshots=5 folder=./screenshotsguidance
Use gowitness-nmap to screenshot web services straight from nmap XML, with port and service filters. Run after a port scan. For a plain URL list use gowitness; for SQLite output use gowitness-db.
Screenshots a plain URL list. gowitness-nmap reads nmap XML and filters by port and service.
Screenshots a URL list into SQLite. Same engine, different input and output shape.
Can consume nmap XML and build an HTML screenshot report for visual triage.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
An nmap XML file feeds gowitness-nmap, which screenshots the discovered web services and writes the captures as a queryable output.
Facts on this page come from the live Trickest tool library.