Discovery
Pull links and page fields from live web hosts
WitnessMe grab mode for links and XPath field extraction.
overview
What witnessme-grab does
In a recon workflow, witnessme-grab sits after URL probing: feed a target or targets file, then collect structured page data instead of images.
Trigger it when you need every link (-l) or a repeated XPath value (-x) across many hosts, including Nmap XML or Nessus input.
Pair with witnessme-screenshot for visuals. Grab mode alone will not produce a screenshot gallery.
use cases
Where witnessme-grab fits
Harvest links across a host list
Enable link collection to pull every link from each live web service, building a seed set of URLs for a crawler or content-discovery stage.
Extract a specific field with XPath
Point an XPath expression at a known element to scrape the same value from many pages at once, such as a version string or a login form action.
Process Nmap or Nessus output directly
Feed an Nmap XML or Nessus targets file so grab mode runs straight off a port scan with no reformatting in between.
Render JavaScript-built pages
Use the headless browser to capture links and content from single-page apps where the markup is assembled in script and a plain HTTP fetch returns nothing.
reference
witnessme-grab inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| XPATH | STRING | -x | Path to use |
| links | BOOLEAN | -l | Get all links |
| target | STRING | · | The target IP, range, CIDR or hostname |
| targets | FILE | · | The target IPs, ranges, CIDRs, hostnames, NMap XML file, or .Nessus file |
Showing key inputs. witnessme-grab exposes 4 inputs in total.
example
Run witnessme-grab
# witnessme-grab: collect inventory metadata from urls.txtwitnessme grab -l urls.txthttps://www.example.com title=Example status=200https://api.example.com title=API status=401https://dev.example.com title=Dev status=200https://staging.example.com title=Staging status=302https://mail.example.com title=Webmail status=200guidance
Choosing witnessme-grab
Run after you have live web URLs and need links or a specific page field. Prefer witnessme-screenshot when triage is visual only.
witnessme-screenshot
Same WitnessMe binary in screenshot mode. Use for image triage; grab mode extracts links and fields.
gowitness
Headless screenshot inventory. Image-first; no -l link harvest or -x XPath extraction.
faq
witnessme-grab questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run witnessme-grab yourself
A targets file feeds witnessme-grab, which drives a headless browser over each host and writes the harvested links and extracted content as a queryable output.
Facts on this page come from the live Trickest tool library.