A tool for visual inspection of websites across many hosts, providing an overview of HTTP-based attack surfaces.
Aquatone is a command-line tool for security reconnaissance that performs visual inspection of websites across a large number of hosts. It automates screenshot capture, HTTP header collection, and report generation to help security professionals quickly assess the web attack surface of target domains or IP ranges.
Security researchers, penetration testers, and red teamers who need to efficiently map and analyze the web presence of many hosts during security assessments.
It provides a fast, automated way to visually inspect web applications at scale, integrates seamlessly with popular reconnaissance tools, and generates comprehensive HTML reports that cluster results for easier analysis.
A Tool for Domain Flyovers
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Accepts input from various reconnaissance tools like Amass and Nmap via stdin, making it easy to plug into existing security pipelines without glue code, as shown in the usage examples.
Generates interactive HTML reports that cluster screenshots and HTTP headers by similarity, helping analysts quickly identify patterns across many hosts for efficient analysis.
Takes screenshots of web applications automatically across discovered hosts, saving significant time for visual inspection during large-scale assessments.
Supports custom port lists and aliases (e.g., 'large', 'xlarge') for scanning web services, allowing adaptability to different assessment scopes as detailed in the ports specification.
Requires Chrome or Chromium, with the README noting unreliable results in headless mode for Google Chrome, complicating setup and potentially affecting reliability in automated environments.
Lacks native DNS enumeration or active scanning capabilities, forcing reliance on external tools for target input, which adds extra steps and toolchain complexity.
Screenshot capture has a high default timeout (30 seconds) and can be resource-intensive, slowing down scans on large target lists compared to header-only tools.