Which renderers can webscreenshot use?

PhantomJS (the legacy default, best results), chrome, chromium, edgechromium, and firefox (version > 57). Set --renderer to choose one, and point --renderer-binary at the executable when it is not already on the PATH.

Can it screenshot pages behind a login?

Yes. Pass --cookie for a session cookie, repeat --header for custom headers, or use --http-username and --http-password for HTTP Basic Auth. Route through a proxy with --proxy, --proxy-auth, and --proxy-type when you need to.

Should I use webscreenshot or httpx's built-in screenshot?

httpx can probe and screenshot in one pass, handy when you already run it for liveness. webscreenshot is a dedicated capturer with renderer choice, labels, cropping, and proxy auth. A common Trickest pattern probes with httpx, then screenshots only the live hosts with webscreenshot.

How is webscreenshot different from gowitness or aquatone?

gowitness and aquatone bundle a report UI or cluster similar pages for you. webscreenshot writes a plain folder of images and leans on flags for renderer, --format, and auth. Reach for it when you want raw captures to feed the next node rather than a standalone report.

Where do the screenshots go and can I change the folder?

They land in the node's FOLDER output, one image named after each URL. On the CLI the default is ./screenshots/ and -o / --output-directory changes it, but that flag is not node-exposed because Trickest manages the output folder for you.

Updated Jul 14, 2026

Discovery

Capture a screenshot of every URL in a target list

Screenshot a list of websites for fast visual triage.

Triage a surface visually Capture a large list in parallel Screenshot authenticated pages

overview

What webscreenshot does

webscreenshot renders web pages and saves an image of each, so you can eyeball a large attack surface instead of reading raw response data. Give it a single URL or a file of targets and it captures every one, which turns hundreds of live hosts into a contact sheet you can scan in minutes.

It drives several renderers, from the legacy PhantomJS to Chrome, Chromium, Edge, and Firefox, and exposes the controls a real browser needs: window size, image format and quality, proxies, custom headers, cookies, and HTTP Basic Auth. Parallel workers keep large lists moving, and a failed-URL file records the targets that never rendered.

On Trickest, webscreenshot is a Discovery node that takes a URL or an input file and writes a folder of images. Run it after probing so you only screenshot live hosts, then use the visual output to spot login panels, default pages, and interesting apps worth a closer look.

source github.com/maaaaz/webscreenshot

use cases

Where webscreenshot fits

Triage a surface visually

Screenshot every live host so an analyst can spot login portals, admin panels, and default pages at a glance instead of reading headers.

Capture a large list in parallel

Point --input-file at a file of URLs and raise --workers to render hundreds of targets without waiting on one at a time.

Screenshot authenticated pages

Pass --cookie, a --header, or --http-username and --http-password so the capture shows the page as a logged-in user would see it.

Choose a renderer and format

Set --renderer to chrome or firefox over the legacy PhantomJS, and use --format and --quality to match how the output gets reviewed.

reference

webscreenshot inputs and flags

28 inputs

Name	Type	Flag	Description
url	STRING	·	Single URL target.
input-file	FILE	--input-file	File containing the target list, one URL per line.
renderer	STRING	--renderer	phantomjs, chrome, chromium, edgechromium, or firefox (default phantomjs).
format	STRING	--format	Output image format (pdf, png, jpg, jpeg, bmp, ppm). Default png.
window-size	STRING	--window-size	Width and height of the screen capture (default 1200,800).
workers	STRING	--workers	Number of parallel execution workers (default 4).
proxy	STRING	--proxy	Proxy to route captures through (e.g. http://proxy.company.com:8080).
cookie	STRING	--cookie	Cookie string to add to each request.

Showing key inputs. webscreenshot exposes 28 inputs in total.

Full flag reference (28 inputs)

Name	Type	Flag	Description
ssl	BOOLEAN	--ssl	Enforce SSL/TLS for every connection.
url	STRING	·	Single URL target.
crop	STRING	--crop	Rectangle t,l,w,h to crop the capture to (default WINDOW_SIZE '0,0,w,h'). Example: 10,20,w,h.
port	STRING	--port	Use the specified port for each target in the input list.
label	BOOLEAN	--label	For each screenshot, create another one displaying the target URL inside it (requires imagemagick).
proxy	STRING	--proxy	Specify a proxy. Example: http://proxy.company.com:8080.
cookie	STRING	--cookie	Cookie string to add. Example: JSESSIONID=1234; YOLO=SWAG.
format	STRING	--format	Output image file format (pdf, png, jpg, jpeg, bmp, ppm). Default png.
header	STRING	--header	Custom or additional header. Repeat for each header. Example: Host: localhost.
quality	STRING	--quality	Output image quality, an integer between 0 and 100 (default 75).
timeout	STRING	--timeout	Renderer execution timeout in seconds (default 30).
workers	STRING	--workers	Number of parallel execution workers (default 4).
renderer	STRING	--renderer	Renderer to use: phantomjs (legacy but best results), chrome, chromium, edgechromium, or firefox (version > 57). Default phantomjs.
custom-js	FILE	--custom-js	File containing JavaScript code to run before taking the screenshot (phantomjs only).
input-file	FILE	--input-file	File containing the target list, one URL per line.
label-size	STRING	--label-size	Font size for the label (default 60).
no-xserver	BOOLEAN	--no-xserver	Run without an X server (via xvfb-run).
proxy-auth	STRING	--proxy-auth	Authentication information for the proxy. Example: user:password.
proxy-type	STRING	--proxy-type	Proxy type: http (default), none (disable completely), or socks5.
window-size	STRING	--window-size	Width and height of the screen capture (default 1200,800).
http-password	STRING	--http-password	Password for HTTP Basic Authentication.
http-username	STRING	--http-username	Username for HTTP Basic Authentication.
multiprotocol	BOOLEAN	--multiprotocol	Perform screenshots over both HTTP and HTTPS for each target.
no-error-file	BOOLEAN	--no-error-file	Do not write a file listing the URLs of failed screenshots (default false).
label-bg-color	STRING	--label-bg-color	Label imagemagick background color (default NavajoWhite).
renderer-binary	FILE	--renderer-binary	Path to the renderer executable when it is not on the PATH.
verbosity-level	STRING	--verbosity	Verbosity level, repeat to increase (-v INFO, -vv DEBUG). Default ERROR.
ajax-max-timeouts	STRING	--ajax-max-timeouts	Per-AJAX-request and max-URL timeout in milliseconds (default 1400,1800).

example

Run webscreenshot

webscreenshot · command

# screenshot a list of live hosts with Chrome, 8 parallel workerswebscreenshot --input-file live-hosts.txt --renderer chrome --workers 8 --format png

sample output

webscreenshot.py version 2.97 [+] 6 URLs to be screenshot[INFO][http://example.com:80/] Screenshot OK[INFO][https://example.com:443/] Screenshot OK[INFO][http://198.51.100.20:8080/] Screenshot OK[INFO][http://203.0.113.45:80/] Screenshot OK[ERROR][http://198.51.100.37:80/] Screenshot somehow failed[+] 5 actual URLs screenshot[+] 1 error(s)

guidance

Choosing webscreenshot

Use webscreenshot to turn a list of live hosts into images for fast visual triage. It captures, it does not probe, so run httpx first to confirm liveness. For automated screenshotting plus an HTML report, gowitness or aquatone are alternatives.

gowitness

Go-based screenshotter with a built-in report UI and database. Heavier, more turnkey reporting.

aquatone

Screenshots plus clustering of similar pages into an HTML report for triage at scale.

httpx

Probes liveness and titles, and can capture screenshots inline, so one node both filters and shoots.

faq

webscreenshot questions

Put one URL per line in a file and point --input-file at it, or pass a single url. Each target renders to an image in the output folder. On Trickest, set the node's input file, pick a --renderer, and the FOLDER output holds one image per host.

Run webscreenshot yourself

A host list is filtered to live hosts by httpx, then webscreenshot captures each one and writes the images as the workflow output.

Run webscreenshot in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url

STRING

Single URL target.

input-file

FILE

--input-file

File containing the target list, one URL per line.

renderer

STRING

--renderer

phantomjs, chrome, chromium, edgechromium, or firefox (default phantomjs).

format

STRING

--format

Output image format (pdf, png, jpg, jpeg, bmp, ppm). Default png.

window-size

STRING

--window-size

Width and height of the screen capture (default 1200,800).

workers

STRING

--workers

Number of parallel execution workers (default 4).

proxy

STRING

--proxy

Proxy to route captures through (e.g. http://proxy.company.com:8080).

STRING

--cookie

Cookie string to add to each request.

Name

Type

Flag

Description

ssl

BOOLEAN

--ssl

Enforce SSL/TLS for every connection.

url

STRING

Single URL target.

crop

STRING

--crop

Rectangle t,l,w,h to crop the capture to (default WINDOW_SIZE '0,0,w,h'). Example: 10,20,w,h.

port

STRING

--port

Use the specified port for each target in the input list.

label

BOOLEAN

--label

For each screenshot, create another one displaying the target URL inside it (requires imagemagick).

proxy

STRING

--proxy

Specify a proxy. Example: http://proxy.company.com:8080.

STRING

--cookie

Cookie string to add. Example: JSESSIONID=1234; YOLO=SWAG.

format

STRING

--format

Output image file format (pdf, png, jpg, jpeg, bmp, ppm). Default png.

header

STRING

--header

Custom or additional header. Repeat for each header. Example: Host: localhost.

quality

STRING

--quality

Output image quality, an integer between 0 and 100 (default 75).

timeout

STRING

--timeout

Renderer execution timeout in seconds (default 30).

workers

STRING

--workers

Number of parallel execution workers (default 4).

renderer

STRING

--renderer

Renderer to use: phantomjs (legacy but best results), chrome, chromium, edgechromium, or firefox (version > 57). Default phantomjs.

custom-js

FILE

--custom-js

File containing JavaScript code to run before taking the screenshot (phantomjs only).

input-file

FILE

--input-file

File containing the target list, one URL per line.

label-size

STRING

--label-size

Font size for the label (default 60).

no-xserver

BOOLEAN

--no-xserver

Run without an X server (via xvfb-run).

proxy-auth

STRING

--proxy-auth

Authentication information for the proxy. Example: user:password.

proxy-type

STRING

--proxy-type

Proxy type: http (default), none (disable completely), or socks5.

window-size

STRING

--window-size

Width and height of the screen capture (default 1200,800).

http-password

STRING

--http-password

Password for HTTP Basic Authentication.

http-username

STRING

--http-username

Username for HTTP Basic Authentication.

multiprotocol

BOOLEAN

--multiprotocol

Perform screenshots over both HTTP and HTTPS for each target.

no-error-file

BOOLEAN

--no-error-file

Do not write a file listing the URLs of failed screenshots (default false).

label-bg-color

STRING

--label-bg-color

Label imagemagick background color (default NavajoWhite).

renderer-binary

FILE

--renderer-binary

Path to the renderer executable when it is not on the PATH.

verbosity-level

STRING

--verbosity

Verbosity level, repeat to increase (-v INFO, -vv DEBUG). Default ERROR.

ajax-max-timeouts

STRING

--ajax-max-timeouts

Per-AJAX-request and max-URL timeout in milliseconds (default 1400,1800).

webscreenshot.py version 2.97 [+] 6 URLs to be screenshot[INFO][http://example.com:80/] Screenshot OK[INFO][https://example.com:443/] Screenshot OK[INFO][http://198.51.100.20:8080/] Screenshot OK[INFO][http://203.0.113.45:80/] Screenshot OK[ERROR][http://198.51.100.37:80/] Screenshot somehow failed[+] 5 actual URLs screenshot[+] 1 error(s)

Capture a screenshot of every URL in a target list

What webscreenshot does

Where webscreenshot fits

Triage a surface visually

Capture a large list in parallel

Screenshot authenticated pages

Choose a renderer and format

webscreenshot inputs and flags

Run webscreenshot

Choosing webscreenshot

gowitness

aquatone

httpx

webscreenshot questions

More Discovery tools

404checker

anew

apkurlgrep

aquatone

aws-s3-data-finder

bfac

Run webscreenshot yourself

Capture a screenshot of every URL in a target list

What webscreenshot does

Where webscreenshot fits

Triage a surface visually

Capture a large list in parallel

Screenshot authenticated pages

Choose a renderer and format

webscreenshot inputs and flags

Run webscreenshot

Choosing webscreenshot

gowitness

aquatone

httpx

webscreenshot questions

More Discovery tools

404checker

anew

apkurlgrep

aquatone

aws-s3-data-finder

bfac

Run webscreenshot yourself