Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Discovery

Screenshot HTTP services from nmap XML

Screenshot web services discovered in an nmap XML scan.

Agent
Turn a port scan into screenshotsScreenshot only the web portsFind web apps on odd ports

overview

What gowitness-nmap does

gowitness-nmap takes nmap XML on -f, selects http and https services from the scan, and captures each interface with headless Chrome without a hand-built URL list.

Nmap-aware filters decide the shoot list: --open keeps open ports, --port narrows port numbers, and --service or --service-contains match detected names. Render still uses -t, --timeout, --fullpage, --user-agent, and --proxy.

Run it after a port-scan stage when open ports should become a visual gallery. Odd-port web apps are captured alongside 80 and 443, which helps spot login pages, default panels, and forgotten consoles.

source github.com/sensepost/gowitness

use cases

Where gowitness-nmap fits

Turn a port scan into screenshots

Feed gowitness-nmap an nmap XML file so every web service the scan found gets captured with headless Chrome in a single pass.

Screenshot only the web ports

Filter by open status, port number, or detected service name so the run captures http and https interfaces and skips everything else.

Find web apps on odd ports

Because input comes from nmap, web services on non-standard ports get screenshotted alongside the usual 80 and 443.

Visually triage scan output

Review the gallery to spot login pages, default panels, and exposed consoles among the services a port scan surfaced.

reference

gowitness-nmap inputs and flags

19 inputs
NameTypeFlagDescription
input-fileFILE-fnmap XML file to read discovered services from.
openBOOLEAN--openOnly select open ports.
portSTRING--portFilter services by port number.
serviceSTRING--serviceFilter by the service name nmap mapped.
service-containsSTRING--service-containsPartial service-name filter (contains match).
threadsSTRING-tThreads used to run (default 4).
fullpageBOOLEAN--fullpageTake full-page screenshots.
proxySTRING--proxyHTTP or SOCKS5 proxy to route requests through.

Showing key inputs. gowitness-nmap exposes 19 inputs in total.

Full flag reference (19 inputs)
NameTypeFlagDescription
input-fileFILE-fnmap XML file to read discovered services from.
openBOOLEAN--openOnly select open ports.
portSTRING--portFilter services by port number.
serviceSTRING--serviceMap service-name filter, matching the service nmap detected.
service-containsSTRING--service-containsPartial service-name filter (contains match).
threadsSTRING-tThreads used to run (default 4).
timeoutSTRING--timeoutPreflight check timeout in seconds (default 10).
delaySTRING--delayDelay in seconds between navigation and screenshot.
fullpageBOOLEAN--fullpageTake full-page screenshots.
pdfBOOLEAN--pdfSave screenshots as PDF.
proxySTRING--proxyHTTP or SOCKS5 proxy to use, in proto://address:port format.
headerSTRING--headerAdditional HTTP header to set on each request.
user-agentSTRING--user-agentUser-agent string to send (defaults to a desktop Chrome UA).
x-resolutionSTRING-XScreenshot resolution width (default 1440).
y-resolutionSTRING-YScreenshot resolution height (default 900).
no-httpBOOLEAN--no-httpDo not prefix http:// where the scheme is missing.
no-httpsBOOLEAN--no-httpsDo not prefix https:// where the scheme is missing.
debugBOOLEAN--debugEnable debug logging.
disable-loggingBOOLEAN--disable-loggingDisable all logging.

example

Run gowitness-nmap

gowitness-nmap · command
# screenshot open web services from an nmap XML scangowitness nmap -f scan.xml --open --service http --fullpage -t 8
sample output
INFO[0000] Reading Nmap XML file        file=scan.xmlINFO[0000] Found 5 web service(s) to screenshotINFO[0001] screenshotting               url=http://198.51.100.10:80INFO[0002] screenshotting               url=https://198.51.100.10:443INFO[0003] screenshotting               url=http://198.51.100.23:8080INFO[0004] screenshotting               url=https://203.0.113.45:8443INFO[0006] screenshotting               url=http://example.com:80INFO[0007] Complete                     screenshots=5 folder=./screenshots

guidance

Choosing gowitness-nmap

Use gowitness-nmap to screenshot web services straight from nmap XML, with port and service filters. Run after a port scan. For a plain URL list use gowitness; for SQLite output use gowitness-db.

gowitness

Screenshots a plain URL list. gowitness-nmap reads nmap XML and filters by port and service.

gowitness-db

Screenshots a URL list into SQLite. Same engine, different input and output shape.

aquatone

Can consume nmap XML and build an HTML screenshot report for visual triage.

faq

gowitness-nmap questions

An nmap XML file on -f. It parses discovered services, keeps web-facing ones, and screenshots each with headless Chrome into a capture folder.

related

More Discovery tools

  1. apkurlgrep

    Extract URLs and endpoints from Android APK files.

  2. cariddi

    Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.

  3. crawlergo

    Browser-driven crawler that harvests requests for downstream scanners.

  4. dirsearch

    Web path scanner.

  5. fallparams

    Crawl pages, harvest potential parameters, write a custom wordlist.

  6. feroxbuster

    Recursive content discovery with smart defaults and rich response filters.

Run gowitness-nmap yourself

An nmap XML file feeds gowitness-nmap, which screenshots the discovered web services and writes the captures as a queryable output.

Open gowitness-nmap in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.