Aquatone is a Go-based tool created by Michael Henriksen (michenriksen) for visual reconnaissance of large numbers of websites. It takes a list of hosts, discovers open HTTP/S ports, captures a screenshot of each responding web service using a headless Chrome/Chromium instance, and compiles everything into a single, browsable HTML report clustered by page similarity. This lets a tester quickly scan hundreds or thousands of hosts visually — spotting login panels, default install pages, error pages, and unusual applications — far faster than manually visiting each URL.
How to Install
Aquatone is not always pre-installed on Kali; install via the Go toolchain or precompiled binary:
# Install via Go
go install github.com/michenriksen/aquatone@latest
# Or download precompiled binary release
wget https://github.com/michenriksen/aquatone/releases/download/v1.7.0/aquatone_linux_amd64_1.7.0.zip
unzip aquatone_linux_amd64_1.7.0.zip -d aquatone
sudo mv aquatone/aquatone /usr/local/bin/
aquatone -version
Chromium is required for screenshotting:
sudo apt install chromium -y
Syntax
cat hosts.txt | aquatone [options]
All Command-Line Options
| Option | Description |
|---|---|
-out <dir> | Output directory for report and screenshots (default: .) |
-ports <list> | Ports to scan (default: common web ports; use xlarge, large, medium presets) |
-threads <n> | Number of concurrent threads |
-http-timeout <ms> | HTTP request timeout in milliseconds |
-scan-timeout <ms> | Port scan timeout in milliseconds |
-screenshot-timeout <ms> | Timeout for screenshot capture |
-resolution <WxH> | Screenshot resolution (default 1440,900) |
-chrome-path <path> | Path to Chrome/Chromium binary |
-save-body | Save raw HTTP response bodies |
-nmap | Parse input as Nmap XML instead of plain host list |
-session <file> | Load a previous Aquatone session file to resume/re-render |
-proxy <url> | Route HTTP requests through a proxy |
-silent | Suppress banner and progress output |
-template-path <path> | Custom HTML report template |
-version | Show Aquatone version |
Basic Usage (Expected Output in Bash)
$ cat hosts.txt | aquatone -out ./aquatone-report
Output:
aquatone v1.7.0 started at 2026-07-19T10:30:00+05:00
----------------------------------------------------
Targets : 25
Threads : 10
Ports : 80, 443, 8000, 8080, 8443
Output dir : ./aquatone-report
http://192.168.1.10 => 200 OK (Apache httpd)
https://192.168.1.11 => 200 OK (nginx)
http://192.168.1.12:8080 => 401 Unauthorized (Jetty)
Wrote HTML report to: aquatone-report/aquatone_report.html
Session data written to: aquatone-report/aquatone_session.json
aquatone is done: 25 hosts scanned in 42.3 seconds
Practical Examples with Output
Example 1 — Basic scan of a small host list
$ cat hosts.txt | aquatone -out results/
Output:
Targets: 10, Threads: 10
Wrote HTML report to: results/aquatone_report.html
Example 2 — Scan with an extended port list
$ cat hosts.txt | aquatone -ports xlarge -out results-full/
Output:
Ports: 80,81,300,443,591,593,832,981,1010,1311,2082,2087,2095,...(4400+ ports)
Scanning 10 hosts across 20 ports each...
Example 3 — Parse Nmap XML output directly
$ nmap -p 80,443,8080 -oX scan.xml 192.168.1.0/24
$ cat scan.xml | aquatone -nmap -out nmap-aquatone/
Output:
Parsed 254 hosts from Nmap XML
32 hosts had open web ports
Wrote HTML report to: nmap-aquatone/aquatone_report.html
Example 4 — Increase thread count for faster scanning
$ cat large-hosts.txt | aquatone -threads 30 -out fast-scan/
Output:
Threads: 30
1000 hosts scanned in 3m18s
Example 5 — Route through Burp proxy for combined recon
$ cat hosts.txt | aquatone -proxy http://127.0.0.1:8080 -out proxied-scan/
Output:
[+] Using proxy 127.0.0.1:8080 for all requests
Wrote HTML report to: proxied-scan/aquatone_report.html
Example 6 — Save raw response bodies for later grep analysis
$ cat hosts.txt | aquatone -save-body -out with-bodies/
$ grep -rl "admin panel" with-bodies/html/
Output:
with-bodies/html/192.168.1.15__443.html
Example 7 — Custom screenshot resolution
$ cat hosts.txt | aquatone -resolution 1920,1080 -out hd-screens/
Output:
Screenshot resolution set to 1920x1080
Wrote HTML report to: hd-screens/aquatone_report.html
Common Use Cases
- Visual triage of hundreds/thousands of discovered hosts after a large subdomain enumeration.
- Rapid identification of login panels, admin interfaces, and default installation pages across an internal network.
- Clustering visually similar pages to detect widespread misconfigurations across many hosts.
- Combining Nmap port scan results directly into a visual report via
-nmap. - Providing screenshot evidence for penetration test reports.
Automation with Bash
#!/bin/bash
# aquatone-pipeline.sh — subdomain enum -> httpx liveness -> aquatone screenshots
DOMAIN="$1"
OUTDIR="aquatone-recon-$(date +%Y%m%d)"
mkdir -p "$OUTDIR"
echo "[*] Enumerating subdomains..."
subfinder -d "$DOMAIN" -silent -o "$OUTDIR/subdomains.txt"
echo "[*] Confirming live hosts..."
cat "$OUTDIR/subdomains.txt" | httpx -silent -o "$OUTDIR/live.txt"
echo "[*] Running Aquatone for visual recon..."
cat "$OUTDIR/live.txt" | aquatone -out "$OUTDIR/aquatone" -threads 20
echo "[+] Report ready at $OUTDIR/aquatone/aquatone_report.html"
Tips and Best Practices
- Feed Aquatone a pre-filtered live-host list (via httpx) instead of raw subdomains to save scan time.
- Use the
-nmapflag when you already have detailed Nmap scan data to avoid redundant port scanning. - Open the generated HTML report in a browser — it groups screenshots by visual similarity, making anomalies easy to spot.
- Increase
-threadscautiously; too high can overload the local Chromium instance or the target network. - Use
-save-bodywhen you need to grep response content later without re-requesting each host.
Troubleshooting
| Issue | Cause | Fix |
|---|---|---|
| Screenshots all blank/black | Chromium sandboxing issue | Run with --no-sandbox Chromium flag or as non-root user |
chrome not found error | Chromium not installed or wrong path | Install Chromium and set -chrome-path explicitly |
| Very slow scanning | High port count (xlarge) on many hosts | Use medium/large preset or reduce host list size |
| Report shows 0 screenshots | All hosts returned non-HTTP responses | Verify target list with httpx first |
| Out-of-memory on very large scans | Too many concurrent Chromium instances | Lower -threads value |
References
- Official GitHub repository: https://github.com/michenriksen/aquatone
- Releases page: https://github.com/michenriksen/aquatone/releases
- Kali tool page: https://www.kali.org/tools/aquatone/