EyeWitness: Complete Guide to Web Screenshotting and Service Enumeration Using Kali Linux

EyeWitness is a Python-based reconnaissance tool developed by the FortyNorth Security team, designed to take screenshots of websites, gather server header information, and identify default credentials where possible. It supports HTTP, HTTPS, and RDP services, and can process input from Nmap XML/Nessus files as well as plain text host lists. Unlike Aquatone (Go/Chromium-based), EyeWitness uses Selenium with a headless Firefox or Chrome driver, and produces a self-contained HTML report with clickable thumbnails, source-code preview, and a “Category” view that groups hosts by default-creds signatures, high-value targets, and non-responsive hosts.

How to Install

Pre-installed on Kali Linux. To verify or reinstall:

which eyewitness
sudo apt update
sudo apt install eyewitness -y
eyewitness --version

Install from source (for latest features):

git clone https://github.com/FortyNorthSecurity/EyeWitness.git
cd EyeWitness/Python/setup
sudo ./setup.sh

Syntax

eyewitness [--web | --rdp | --headless] -f <targets_file> [options]
eyewitness --web --single <url> [options]

All Command-Line Options

Option	Description
--web	Screenshot HTTP/HTTPS services
--rdp	Screenshot RDP services
--headless	Screenshot only, no protocol-specific parsing
-f <file>	File containing list of URLs/hosts
--single <url>	Screenshot a single URL
-x <file>	Parse Nmap XML file as input
--nessus <file>	Parse Nessus scan file as input
-d <dir>	Output directory for report
--timeout <secs>	Max time to wait for a response (default 7)
--threads <n>	Number of concurrent threads
--max-retries <n>	Retry attempts on failed connections
--resolve	Resolve IP addresses to hostnames
--no-prompt	Skip interactive prompts (for automation)
--user-agent <string>	Custom User-Agent string
--proxy-ip <ip>	Proxy IP address
--proxy-port <port>	Proxy port
--proxy-type <type>	Proxy type (http/socks5)
--difference <n>	Similarity threshold for grouping screenshots
--jitter <n>	Add random delay (%) between requests
--show-selenium	Show the Selenium browser window (non-headless debug mode)
--resolve-ip	Show resolved IPs in report
--ocr	Enable OCR text extraction on screenshots
--only-good	Only report on hosts that responded successfully
--cycle <secs>	Delay between screenshot cycles
--results <n>	Limit report to N results per page

Basic Usage (Expected Output in Bash)

$ eyewitness --web -f urls.txt -d eyewitness-report --no-prompt

Output:

###############################################################
#                        EyeWitness                           #
###############################################################
Starting Web Requests (25 Hosts)
[*] Attempting to screenshot http://192.168.1.10
[*] Attempting to screenshot https://192.168.1.11
[*] Attempting to screenshot http://192.168.1.12:8080

Done! Report written to eyewitness-report/report.html

Practical Examples with Output

Example 1 — Screenshot a single target

$ eyewitness --web --single https://testphp.vulnweb.com -d single-target --no-prompt

Output:

[*] Attempting to screenshot https://testphp.vulnweb.com
[+] Screenshot saved: single-target/screens/testphp.vulnweb.com.png
Report written to single-target/report.html

Example 2 — Bulk scan from a target list

$ eyewitness --web -f subdomains.txt -d bulk-report --no-prompt --threads 10

Output:

Starting Web Requests (150 Hosts)
[*] 142/150 completed successfully
[!] 8 hosts timed out
Report written to bulk-report/report.html

Example 3 — Import Nmap XML scan directly

$ nmap -p 80,443,8080 -oX scan.xml 192.168.1.0/24
$ eyewitness -x scan.xml -d nmap-eyewitness --no-prompt

Output:

[*] Parsing Nmap XML file: scan.xml
[*] Found 34 web services
Starting Web Requests (34 Hosts)
Report written to nmap-eyewitness/report.html

Example 4 — Import Nessus scan results

$ eyewitness --nessus scan.nessus -d nessus-report --no-prompt

Output:

[*] Parsing Nessus file: scan.nessus
[*] Found 58 HTTP/HTTPS services
Report written to nessus-report/report.html

Example 5 — Scan through a SOCKS proxy

$ eyewitness --web -f targets.txt --proxy-ip 127.0.0.1 --proxy-port 9050 --proxy-type socks5 -d proxied-scan --no-prompt

Output:

[*] Using SOCKS5 proxy 127.0.0.1:9050
Starting Web Requests (10 Hosts)
Report written to proxied-scan/report.html

Example 6 — Increase timeout for slow internal hosts

$ eyewitness --web -f internal-hosts.txt --timeout 15 -d internal-report --no-prompt

Output:

Starting Web Requests (40 Hosts)
[*] Timeout set to 15 seconds
[+] 38/40 completed successfully

Example 7 — Custom User-Agent for evasion

$ eyewitness --web -f targets.txt --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" -d ua-scan --no-prompt

Output:

Starting Web Requests (20 Hosts)
Report written to ua-scan/report.html

Example 8 — Only report successful responses

$ eyewitness --web -f targets.txt --only-good -d filtered-report --no-prompt

Output:

Starting Web Requests (100 Hosts)
[*] Filtering: only successful responses included
[+] 67 hosts included in final report

Common Use Cases

• Rapid visual triage of internal network web services during an internal penetration test.
• Reviewing large external attack-surface screenshots for default credential pages and admin panels.
• Combining directly with Nmap/Nessus scan output to skip manual URL list creation.
• Identifying default installation pages (Tomcat manager, phpMyAdmin, Jenkins) across many hosts.
• Producing client-ready screenshot evidence in penetration test reports.

Automation with Bash

#!/bin/bash
# eyewitness-from-nmap.sh — scan a subnet, extract web ports, and screenshot everything

SUBNET="$1"
OUTDIR="eyewitness-$(date +%Y%m%d)"
mkdir -p "$OUTDIR"

echo "[*] Running Nmap scan on $SUBNET..."
nmap -p 80,443,8000,8080,8443 -oX "$OUTDIR/scan.xml" "$SUBNET"

echo "[*] Running EyeWitness against discovered web services..."
eyewitness -x "$OUTDIR/scan.xml" -d "$OUTDIR/report" --no-prompt --threads 10

echo "[+] Report ready: $OUTDIR/report/report.html"

Tips and Best Practices

• Always use --no-prompt in automated/scripted runs — the interactive prompt otherwise blocks execution.
• Feed EyeWitness Nmap XML directly (-x) rather than manually building target lists when Nmap data already exists.
• Use --jitter on external assessments to add randomized timing and reduce detection footprint.
• Increase --timeout for slow internal legacy systems to avoid false negatives.
• Review the report’s “Category” grouping first — it surfaces default credential pages automatically.

Troubleshooting

Issue	Cause	Fix
geckodriver/chromedriver not found	Selenium driver missing	Install via sudo apt install firefox-esr and re-run setup.sh
Many hosts show blank screenshots	Timeout too short	Increase --timeout value
Report generation fails	Output directory permission issue	Use a writable -d path
Interactive prompt hangs in CI/script	Missing --no-prompt flag	Always add --no-prompt for automation
Proxy connections fail	Wrong --proxy-type	Match proxy type exactly (http vs socks5)

References

• Official GitHub repository: https://github.com/FortyNorthSecurity/EyeWitness
• Kali tool page: https://www.kali.org/tools/eyewitness/
• FortyNorth Security blog: https://www.fortynorthsecurity.com/