How to use Aquatone with Nmap XML output?

Pipe the Nmap XML file into Aquatone with the '-nmap' flag: 'cat scan.xml | aquatone -nmap'. This tells Aquatone to parse the input as Nmap/Masscan XML for port scan results.

Aquatone vs EyeWitness for web screenshotting?

Aquatone excels at integration with other tools via stdin and generates clustered HTML reports, while EyeWitness may offer different scripting options. Aquatone is better for automated workflows, but both serve visual reconnaissance purposes.

Can Aquatone automatically detect vulnerabilities?

No, Aquatone focuses on reconnaissance—collecting screenshots, headers, and response bodies. It doesn't perform active exploitation or deep vulnerability scanning; it's meant for surface analysis and reporting.

How to speed up Aquatone for a large list of targets?

Increase the threads with '-threads' for concurrent processing, reduce ports scanned with '-ports', and disable body saving with '-save-body=false' to lower disk I/O and improve performance.

Does Aquatone work on Windows without Chromium?

It requires Chrome or Chromium installed, as noted in the README. On Windows, you must ensure Chromium is available and specify the path with '-chrome-path' if not in default locations, which can be tricky.

How to change the screenshot resolution in Aquatone?

Use the '-resolution' flag followed by width and height, e.g., '-resolution 1920,1080'. The default is 1440x900, but you can adjust it based on your needs for clearer visuals.

Open-Awesome

AQUATONE

MITGov1.7.0

A tool for visual inspection of websites across many hosts, providing an overview of HTTP-based attack surfaces.

Visit Website GitHub

6.0k stars900 forks0 contributors

What is AQUATONE?

Aquatone is a command-line tool for security reconnaissance that performs visual inspection of websites across a large number of hosts. It automates screenshot capture, HTTP header collection, and report generation to help security professionals quickly assess the web attack surface of target domains or IP ranges.

Target Audience

Security researchers, penetration testers, and red teamers who need to efficiently map and analyze the web presence of many hosts during security assessments.

Value Proposition

It provides a fast, automated way to visually inspect web applications at scale, integrates seamlessly with popular reconnaissance tools, and generates comprehensive HTML reports that cluster results for easier analysis.

Overview

A Tool for Domain Flyovers

Use Cases

Best For

Mapping the web attack surface of a large organization during penetration tests.
Quickly visualizing all subdomains discovered during DNS enumeration.
Generating HTML reports of web application screenshots for client deliverables.
Integrating with Nmap or Masscan scans to analyze open HTTP ports.
Collecting HTTP headers and response bodies for offline vulnerability analysis.
Identifying similar-looking web applications across different hosts for clustering analysis.

Not Ideal For

Environments where installing or managing Chromium browsers is restricted or impractical
Assessments requiring deep, automated vulnerability exploitation beyond surface reconnaissance
Red teams focused solely on non-web protocols or internal network services without HTTP interfaces

Pros & Cons

Pros

Seamless Tool Integration

Accepts input from various reconnaissance tools like Amass and Nmap via stdin, making it easy to plug into existing security pipelines without glue code, as shown in the usage examples.

Visual Clustering Reports

Generates interactive HTML reports that cluster screenshots and HTTP headers by similarity, helping analysts quickly identify patterns across many hosts for efficient analysis.

Automated Screenshot Capture

Takes screenshots of web applications automatically across discovered hosts, saving significant time for visual inspection during large-scale assessments.

Flexible Port Scanning

Supports custom port lists and aliases (e.g., 'large', 'xlarge') for scanning web services, allowing adaptability to different assessment scopes as detailed in the ports specification.

Cons

Browser Dependency Issues

Requires Chrome or Chromium, with the README noting unreliable results in headless mode for Google Chrome, complicating setup and potentially affecting reliability in automated environments.

No Built-in Host Discovery

Lacks native DNS enumeration or active scanning capabilities, forcing reliance on external tools for target input, which adds extra steps and toolchain complexity.

Performance Overheads

Screenshot capture has a high default timeout (30 seconds) and can be resource-intensive, slowing down scans on large target lists compared to header-only tools.

Frequently Asked Questions

Related Projects

Sublist3r

Fast subdomains enumeration tool for penetration testers

Stars11,065

Forks2,213

Last commit2 years ago

subDomainsBrute

A fast sub domain brute tool for pentesters

Stars3,622

Forks1,004

Last commit4 years ago

domain_analyzer

Analyze the security of any domain by finding all the information possible. Made in python.

Stars1,864

Forks235

Last commit3 years ago

Certificate Transparency

Auditing for TLS certificates.

Stars887

Forks288