Reporting Tools

eyewitness

eyewitness solves the problem of having hundreds of web services and no time to open them all. Give it a list of URLs (or hosts, or an nmap XML file) and it visits each one, takes a screenshot, records the server headers and page title, and builds a single HTML report you can scroll through. In minutes you can triage a huge attack surface visually — spotting default install pages, login portals, admin panels, and forgotten dev sites — instead of clicking through them one by one.

Installed from the AUR (as eyewitness-git); Security → Reporting Tools → eyewitness.

The help it prints

usage: EyeWitness.py [--web] [-f Filename] [-x Filename.xml]
                     [--single Single URL] [--no-dns] [--timeout Timeout]
                     [--jitter # of Seconds] [--delay # of Seconds]
                     [--threads # of Threads]
                     [--max-retries Max retries on a timeout]
                     [-d Output Directory] [--results Results/Page]
                     [--no-prompt] [--no-clear] [--user-agent User Agent]
                     [--difference Difference Threshold]
                     [--proxy-ip 127.0.0.1] [--proxy-port 8080]
                     [--proxy-type socks5] [--show-selenium] [--resolve]
                     [--add-http-ports ADD_HTTP_PORTS]
                     [--add-https-ports ADD_HTTPS_PORTS]
                     [--only-ports ONLY_PORTS] [--prepend-https]
                     [--validate-urls] [--skip-validation]
                     [--selenium-log-path SELENIUM_LOG_PATH]
                     [--cookies key1=value1,key2=value2] [--width 1366]
                     [--height 768] [--resume ew.db] [--config config.json]
                     [--create-config]

EyeWitness is a tool used to capture screenshots from a list of URLs

Protocols:
  --web                 HTTP Screenshot using Selenium

Input Options:
  -f Filename           Line-separated file containing URLs to capture
  -x Filename.xml       Nmap XML or .Nessus file
  --single Single URL   Single URL/Host to capture
  --no-dns              Skip DNS resolution when connecting to websites

Timing Options:
  --timeout Timeout     Maximum number of seconds to wait while requesting a
                        web page (Default: 7)
  --jitter # of Seconds
                        Randomize URLs and add a random delay between requests
  --delay # of Seconds  Delay between the opening of the navigator and taking
                        the screenshot
  --threads # of Threads
                        Number of threads to use (default: 16 based on CPU
                        cores)
  --max-retries Max retries on a timeout
                        Max retries on timeouts

Report Output Options:
  -d Output Directory   Output directory for screenshots and reports
  --results Results/Page
                        Number of results per report page (default: 25)
  --no-prompt           Skip prompt to open report when complete
  --no-clear            Don't clear screen buffer (default behavior)

Web Options:
  --user-agent User Agent
                        User Agent to use for all requests
  --difference Difference Threshold
                        Difference threshold when determining if user agent
                        requests are close "enough" (Default: 50)
  --proxy-ip 127.0.0.1  IP of web proxy to go through
  --proxy-port 8080     Port of web proxy to go through
  --proxy-type socks5   Proxy type (socks5/http)
  --show-selenium       Show display for selenium
  --resolve             Resolve IP/Hostname for targets
  --add-http-ports ADD_HTTP_PORTS
                        Comma-separated additional port(s) to assume are http
                        (e.g. '8018,8028')
  --add-https-ports ADD_HTTPS_PORTS
                        Comma-separated additional port(s) to assume are https
                        (e.g. '8018,8028')
  --only-ports ONLY_PORTS
                        Comma-separated list of exclusive ports to use (e.g.
                        '80,8080')
  --prepend-https       Prepend http:// and https:// to URLs without either
  --validate-urls       Only validate URLs without taking screenshots
  --skip-validation     Skip URL validation checks (use with caution)
  --selenium-log-path SELENIUM_LOG_PATH
                        Selenium ChromeDriver log path
  --cookies key1=value1,key2=value2
                        Additional cookies to add to the request
  --width 1366          Screenshot window image width size. 600-7680 (eg.
                        1920)
  --height 768          Screenshot window image height size. 400-4320 (eg.
                        1080)

Resume Options:
  --resume ew.db        Path to db file if you want to resume

Configuration Options:
  --config config.json  Configuration file path
  --create-config       Create sample configuration file

Examples

# Screenshot a list of URLs
eyewitness --web -f urls.txt -d report/

# Feed it nmap XML output directly
eyewitness -x nmap.xml --web -d report/

# Add a delay and prepend https to bare hosts
eyewitness --web -f hosts.txt --prepend-https --delay 5 -d report/

Open the report/report.html it produces to browse every service’s screenshot and headers in one page — a fast way to decide where to spend your attention, and clean evidence for the write-up.