Visual Recon

Automatically screenshot every live host to triage hundreds of subdomains visually instead of manually opening each one. Combined with technology fingerprinting, this reveals technology stacks, default CMS install pages, admin panels, and misconfigured services at a glance. Process 500+ hosts in minutes and identify high-value targets by visual inspection.

When to Use

• You have 100+ live subdomains and need to prioritize targets quickly.
• Manual browsing is too slow for bulk reconnaissance.
• Need to identify default install pages (WordPress setup, phpMyAdmin login, Jenkins dashboard).
• Want to compare visual fingerprints across subdomains (shared infrastructure).
• Target serves different content based on User-Agent or geolocation.

Prerequisites

• terminal gowitness, httpx, and curl.
• gowitness installed: go install github.com/sensepost/gowitness@latest.
• A list of alive subdomains from subdomain-enumeration.

Quick Start