Which renderers can webscreenshot use?

phantomjs (legacy default), chrome, chromium, edgechromium, and firefox (version > 57). Set --renderer, and point --renderer-binary at the executable when it is not on PATH.

Can it screenshot pages behind a login?

Yes. Pass --cookie for a session cookie, repeat --header for custom headers, or use --http-username and --http-password for HTTP Basic Auth. Route through --proxy with --proxy-auth and --proxy-type when needed.

Should I use webscreenshot or httpx screenshots?

httpx can probe and screenshot in one pass when you already run it for liveness. webscreenshot is a dedicated capturer with renderer choice, labels, cropping, and proxy auth. A common pattern probes with httpx, then screenshots only live hosts here.

How is webscreenshot different from gowitness or aquatone?

gowitness and aquatone bundle a report UI or cluster similar pages. webscreenshot writes a plain folder of images and exposes --renderer, --format, and auth flags. Reach for it when raw captures feed the next node.

Updated Jul 14, 2026

Discovery

Screenshot every URL in a target list

Browser-driven screenshots for visual host triage.

Triage a surface visually Capture a large list in parallel Screenshot authenticated pages

overview

What webscreenshot does

webscreenshot renders each URL and writes an image to a folder. Point --input-file at one URL per line, or pass a single url. Choose --renderer among phantomjs, chrome, chromium, edgechromium, or firefox.

Use it after a liveness probe when you need a contact sheet of login panels, default pages, and odd apps. Control --format, --window-size, --workers, --proxy, and --cookie (or --http-username / --http-password) for auth and scale.

Trickest provides webscreenshot as a managed Discovery node: input file in, folder of images out. Prefer httpx when probe-and-screenshot should stay one step. Prefer gowitness or aquatone when you want a bundled report UI.

source github.com/maaaaz/webscreenshot

use cases

Where webscreenshot fits

Triage a surface visually

Screenshot every live host so an analyst can spot login portals, admin panels, and default pages at a glance instead of reading headers.

Capture a large list in parallel

Point --input-file at a file of URLs and raise --workers to render hundreds of targets without waiting on one at a time.

Screenshot authenticated pages

Pass --cookie, a --header, or --http-username and --http-password so the capture shows the page as a logged-in user would see it.

Choose a renderer and format

Set --renderer to chrome or firefox over the legacy PhantomJS, and use --format and --quality to match how the output gets reviewed.

reference

webscreenshot inputs and flags

28 inputs

Name	Type	Flag	Description
url	STRING	·	Single URL target.
input-file	FILE	--input-file	File containing the target list, one URL per line.
renderer	STRING	--renderer	phantomjs, chrome, chromium, edgechromium, or firefox (default phantomjs).
format	STRING	--format	Output image format (pdf, png, jpg, jpeg, bmp, ppm). Default png.
window-size	STRING	--window-size	Width and height of the screen capture (default 1200,800).
workers	STRING	--workers	Number of parallel execution workers (default 4).
proxy	STRING	--proxy	Proxy to route captures through (e.g. http://proxy.company.com:8080).
cookie	STRING	--cookie	Cookie string to add to each request.

Showing key inputs. webscreenshot exposes 28 inputs in total.

Full flag reference (28 inputs)

Name	Type	Flag	Description
ssl	BOOLEAN	--ssl	Enforce SSL/TLS for every connection.
url	STRING	·	Single URL target.
crop	STRING	--crop	Rectangle t,l,w,h to crop the capture to (default WINDOW_SIZE '0,0,w,h'). Example: 10,20,w,h.
port	STRING	--port	Use the specified port for each target in the input list.
label	BOOLEAN	--label	For each screenshot, create another one displaying the target URL inside it (requires imagemagick).
proxy	STRING	--proxy	Specify a proxy. Example: http://proxy.company.com:8080.
cookie	STRING	--cookie	Cookie string to add. Example: JSESSIONID=1234; YOLO=SWAG.
format	STRING	--format	Output image file format (pdf, png, jpg, jpeg, bmp, ppm). Default png.
header	STRING	--header	Custom or additional header. Repeat for each header. Example: Host: localhost.
quality	STRING	--quality	Output image quality, an integer between 0 and 100 (default 75).
timeout	STRING	--timeout	Renderer execution timeout in seconds (default 30).
workers	STRING	--workers	Number of parallel execution workers (default 4).
renderer	STRING	--renderer	Renderer to use: phantomjs (legacy but best results), chrome, chromium, edgechromium, or firefox (version > 57). Default phantomjs.
custom-js	FILE	--custom-js	File containing JavaScript code to run before taking the screenshot (phantomjs only).
input-file	FILE	--input-file	File containing the target list, one URL per line.
label-size	STRING	--label-size	Font size for the label (default 60).
no-xserver	BOOLEAN	--no-xserver	Run without an X server (via xvfb-run).
proxy-auth	STRING	--proxy-auth	Authentication information for the proxy. Example: user:password.
proxy-type	STRING	--proxy-type	Proxy type: http (default), none (disable completely), or socks5.
window-size	STRING	--window-size	Width and height of the screen capture (default 1200,800).
http-password	STRING	--http-password	Password for HTTP Basic Authentication.
http-username	STRING	--http-username	Username for HTTP Basic Authentication.
multiprotocol	BOOLEAN	--multiprotocol	Perform screenshots over both HTTP and HTTPS for each target.
no-error-file	BOOLEAN	--no-error-file	Do not write a file listing the URLs of failed screenshots (default false).
label-bg-color	STRING	--label-bg-color	Label imagemagick background color (default NavajoWhite).
renderer-binary	FILE	--renderer-binary	Path to the renderer executable when it is not on the PATH.
verbosity-level	STRING	--verbosity	Verbosity level, repeat to increase (-v INFO, -vv DEBUG). Default ERROR.
ajax-max-timeouts	STRING	--ajax-max-timeouts	Per-AJAX-request and max-URL timeout in milliseconds (default 1400,1800).

example

Run webscreenshot

webscreenshot · command

# screenshot a list of live hosts with Chrome, 8 parallel workerswebscreenshot --input-file live-hosts.txt --renderer chrome --workers 8 --format png

sample output

webscreenshot.py version 2.97 [+] 6 URLs to be screenshot[INFO][http://example.com:80/] Screenshot OK[INFO][https://example.com:443/] Screenshot OK[INFO][http://198.51.100.20:8080/] Screenshot OK[INFO][http://203.0.113.45:80/] Screenshot OK[ERROR][http://198.51.100.37:80/] Screenshot somehow failed[+] 5 actual URLs screenshot[+] 1 error(s)

guidance

Choosing webscreenshot

Use webscreenshot to turn live hosts into images for visual triage. It captures; it does not probe. Run httpx first. For screenshots plus an HTML report, prefer gowitness or aquatone.

gowitness

Go-based screenshotter with a built-in report UI and database. Heavier stack when you want the report UI, not just PNGs.

aquatone

Screenshots plus clustering of similar pages into an HTML report for triage at scale.

httpx

Probes liveness and titles, and can capture screenshots inline, so one node both filters and shoots.

faq

webscreenshot questions

Put one URL per line in a file and set --input-file, or pass a single url. Each target renders to an image in the FOLDER output. Pick --renderer and raise --workers for larger lists.

Run webscreenshot yourself

A host list is filtered to live hosts by httpx, then webscreenshot captures each one and writes the images as the workflow output.

Open webscreenshot in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.

Screenshot every URL in a target list

What webscreenshot does

Where webscreenshot fits

Triage a surface visually

Capture a large list in parallel

Screenshot authenticated pages

Choose a renderer and format

webscreenshot inputs and flags

Run webscreenshot

Choosing webscreenshot

gowitness

aquatone

httpx

webscreenshot questions

More Discovery tools

apkurlgrep

cariddi

crawlergo

dirsearch

fallparams

feroxbuster

Run webscreenshot yourself