EyeWitness: Complete Guide to Web Screenshotting and Service Enumeration Using Kali Linux

EyeWitness is a Python-based reconnaissance tool developed by the FortyNorth Security team, designed to take screenshots of websites, gather server header information, and identify default credentials where possible. It supports HTTP, HTTPS, and RDP services, and can process input from Nmap XML/Nessus files as well as plain text host lists. Unlike Aquatone (Go/Chromium-based), EyeWitness uses Selenium with a headless Firefox or Chrome driver, and produces a self-contained HTML report with clickable thumbnails, source-code preview, and a “Category” view that groups hosts by default-creds signatures, high-value targets, and non-responsive hosts.

How to Install

Pre-installed on Kali Linux. To verify or reinstall:

which eyewitness
sudo apt update
sudo apt install eyewitness -y
eyewitness --version

Install from source (for latest features):

git clone https://github.com/FortyNorthSecurity/EyeWitness.git
cd EyeWitness/Python/setup
sudo ./setup.sh

Syntax

eyewitness [--web | --rdp | --headless] -f <targets_file> [options]
eyewitness --web --single <url> [options]

All Command-Line Options

Basic Usage (Expected Output in Bash)

$ eyewitness --web -f urls.txt -d eyewitness-report --no-prompt

Output:

###############################################################
#                        EyeWitness                           #
###############################################################
Starting Web Requests (25 Hosts)
[*] Attempting to screenshot http://192.168.1.10
[*] Attempting to screenshot https://192.168.1.11
[*] Attempting to screenshot http://192.168.1.12:8080

Done! Report written to eyewitness-report/report.html

Practical Examples with Output

Example 1 — Screenshot a single target

$ eyewitness --web --single https://testphp.vulnweb.com -d single-target --no-prompt

Output:

[*] Attempting to screenshot https://testphp.vulnweb.com
[+] Screenshot saved: single-target/screens/testphp.vulnweb.com.png
Report written to single-target/report.html

Example 2 — Bulk scan from a target list

$ eyewitness --web -f subdomains.txt -d bulk-report --no-prompt --threads 10

Output:

Starting Web Requests (150 Hosts)
[*] 142/150 completed successfully
[!] 8 hosts timed out
Report written to bulk-report/report.html

Example 3 — Import Nmap XML scan directly

$ nmap -p 80,443,8080 -oX scan.xml 192.168.1.0/24
$ eyewitness -x scan.xml -d nmap-eyewitness --no-prompt

Output:

[*] Parsing Nmap XML file: scan.xml
[*] Found 34 web services
Starting Web Requests (34 Hosts)
Report written to nmap-eyewitness/report.html

Example 4 — Import Nessus scan results

$ eyewitness --nessus scan.nessus -d nessus-report --no-prompt

Output:

[*] Parsing Nessus file: scan.nessus
[*] Found 58 HTTP/HTTPS services
Report written to nessus-report/report.html

Example 5 — Scan through a SOCKS proxy

$ eyewitness --web -f targets.txt --proxy-ip 127.0.0.1 --proxy-port 9050 --proxy-type socks5 -d proxied-scan --no-prompt

Output:

[*] Using SOCKS5 proxy 127.0.0.1:9050
Starting Web Requests (10 Hosts)
Report written to proxied-scan/report.html

Example 6 — Increase timeout for slow internal hosts

$ eyewitness --web -f internal-hosts.txt --timeout 15 -d internal-report --no-prompt

Output:

Starting Web Requests (40 Hosts)
[*] Timeout set to 15 seconds
[+] 38/40 completed successfully

Example 7 — Custom User-Agent for evasion

$ eyewitness --web -f targets.txt --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" -d ua-scan --no-prompt

Output:

Starting Web Requests (20 Hosts)
Report written to ua-scan/report.html

Example 8 — Only report successful responses

$ eyewitness --web -f targets.txt --only-good -d filtered-report --no-prompt

Output:

Starting Web Requests (100 Hosts)
[*] Filtering: only successful responses included
[+] 67 hosts included in final report

Common Use Cases

• Rapid visual triage of internal network web services during an internal penetration test.
• Reviewing large external attack-surface screenshots for default credential pages and admin panels.
• Combining directly with Nmap/Nessus scan output to skip manual URL list creation.
• Identifying default installation pages (Tomcat manager, phpMyAdmin, Jenkins) across many hosts.
• Producing client-ready screenshot evidence in penetration test reports.

Automation with Bash

#!/bin/bash
# eyewitness-from-nmap.sh — scan a subnet, extract web ports, and screenshot everything

SUBNET="$1"
OUTDIR="eyewitness-$(date +%Y%m%d)"
mkdir -p "$OUTDIR"

echo "[*] Running Nmap scan on $SUBNET..."
nmap -p 80,443,8000,8080,8443 -oX "$OUTDIR/scan.xml" "$SUBNET"

echo "[*] Running EyeWitness against discovered web services..."
eyewitness -x "$OUTDIR/scan.xml" -d "$OUTDIR/report" --no-prompt --threads 10

echo "[+] Report ready: $OUTDIR/report/report.html"

Tips and Best Practices

• Always use --no-prompt in automated/scripted runs — the interactive prompt otherwise blocks execution.
• Feed EyeWitness Nmap XML directly (-x) rather than manually building target lists when Nmap data already exists.
• Use --jitter on external assessments to add randomized timing and reduce detection footprint.
• Increase --timeout for slow internal legacy systems to avoid false negatives.
• Review the report’s “Category” grouping first — it surfaces default credential pages automatically.

Troubleshooting

References

• Official GitHub repository: https://github.com/FortyNorthSecurity/EyeWitness
• Kali tool page: https://www.kali.org/tools/eyewitness/
• FortyNorth Security blog: https://www.fortynorthsecurity.com/