visual-recon

name	visual-recon
description	Screenshot all live hosts for rapid visual triage and technology fingerprinting.
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
platforms	["linux"]
compatibility	Requires curl, httpx, python3
tags	["recon","screenshot","visual","triage","fingerprinting","technology"]
category	recon
related_skills	["subdomain-enumeration","web-enumeration","cms-detection","port-service-discovery"]

Visual Recon

Automatically screenshot every live host to triage hundreds of subdomains visually instead of manually opening each one. Combined with technology fingerprinting, this reveals technology stacks, default CMS install pages, admin panels, and misconfigured services at a glance. Process 500+ hosts in minutes and identify high-value targets by visual inspection.

When to Use

• You have 100+ live subdomains and need to prioritize targets quickly.
• Manual browsing is too slow for bulk reconnaissance.
• Need to identify default install pages (WordPress setup, phpMyAdmin login, Jenkins dashboard).
• Want to compare visual fingerprints across subdomains (shared infrastructure).
• Target serves different content based on User-Agent or geolocation.

Prerequisites

• terminal gowitness, httpx, and curl.
• gowitness installed: go install github.com/sensepost/gowitness@latest.
• A list of alive subdomains from subdomain-enumeration.

Quick Start

gowitness file -f alive_subs.txt -P ./screenshots/ --no-http

Procedure

Phase 1 — Mass Screenshot Capture

# gowitness — fast, Go-based screenshot tool
gowitness file -f alive_subs.txt \
  -P ./screenshots/ \
  --no-http \
  --timeout 15 \
  --resolution-x 1440 \
  --resolution-y 900

# With database for searchable results
gowitness file -f alive_subs.txt -P ./screenshots/ --no-http \
  --db gowitness.db --chrome-window-x 1440 --chrome-window-y 900

# Query results
gowitness report list --db gowitness.db
gowitness report generate --db gowitness.db

# eyewitness — with HTML report generation
python3 EyeWitness.py \
  -f alive_subs.txt \
  --web \
  -d ./eyewitness_output/ \
  --timeout 15 \
  --no-prompt

Phase 2 — Headless Mode for JS-Rendered Sites

# Single-page applications need JS execution
gowitness single -u https://[SPA_COMPANY] \
  -P ./screenshots/ \
  --chrome-window-x 1440 --chrome-window-y 900

# Batch headless capture
cat spa_urls.txt | while read url; do
  gowitness single -u  -P ./screenshots/