Tool – EyeWitness

By Red Siege | April 9, 2026

EyeWitness: Because Nobody Has Time to Visit 500 URLs

Every pentest has that moment during recon where you’ve got a list of web servers a mile long and absolutely no idea what’s running on any of them. Maybe Nmap gave you 300 open ports on 80 and 443. Maybe Nessus spit out a spreadsheet that makes your eyes glaze over. Either way, you’re staring at a wall of IPs and URLs with zero context about what’s actually sitting behind them.

That’s where EyeWitness comes in. Built by us here at Red Siege, EyeWitness takes a list of URLs, visits each one, screenshots the page, grabs server header info, and flags default credentials where it recognizes the application. Instead of manually browsing to hundreds of sites, you get a clean HTML report you can scroll through in minutes.

Why It Exists

Recon is the foundation of any good assessment. The faster you can triage what’s on a network, the faster you can prioritize your attack surface. Before EyeWitness, the process was painful. Open a browser, paste a URL, take a note, rinse and repeat a few hundred times, or for the more savvy ones run a loop using curl. That’s a lot of wasted time on something that doesn’t require human judgment until you actually see the page.

EyeWitness automates the tedious part and lets you focus on the interesting part, figuring out what to target. It’s one of those tools that once you use it, you can’t imagine a workflow without it.

What It Does

EyeWitness is a web screenshotting tool powered by Chromium. Feed it a text file of URLs, Nmap XML output, or Nessus XML, and it handles the rest. It captures screenshots of every site, pulls HTTP response headers, and cross-references what it finds against a signature database of sorts with over 500 known default credentials.

The output is an HTML report organized by category such as high value targets, directory listings, CMS platforms, network devices, printers, IDRAC and ILO management interfaces, NAS devices, VoIP systems, cameras, pretty much anything with a login form, and more. Similar pages get grouped together automatically, so instead of scrolling through 400 random screenshots you’re looking at clusters of related services and status codes. The report also flags every page where it recognizes the application and knows the default credentials. This saves me huge amount of time on every engagement.

The Commands You’ll Actually Use

The most common way to run EyeWitness is feeding it Nmap output directly. Run your service scan, hand the XML to EyeWitness, and let it build URLs from whatever it finds on web ports.

If you’ve got a plain text file of URLs instead, that works too.

Here’s one that comes up a lot. You’ve got a list of bare hostnames or IPs from recon and none of them have a protocol prefix. The –prepend-https flag will automatically try both http and https for every entry.

When you’re working with Nmap XML and the target environment is running web services on non-standard ports, you can tell EyeWitness to treat those ports as HTTP or HTTPS. Or if you only care about specific ports, filter everything else out.

Pro-tip: If you want to route EyeWitness through Burp or another proxy during an assessment, there’s built-in proxy support. Works with both HTTP and SOCKS5.

For large scans or situations where you don’t want to blast every URL at once, the jitter and delay flags are your friends. Jitter randomizes the URL order and adds a random pause between requests. Delay adds a fixed wait between the page loading and the screenshot being taken, which also helps with pages that need a second to render JavaScript.

Keep in mind that cranking threads up will get results faster but it also makes you louder on the network. On an internal assessment where you’re trying to stay under the radar, dial it back. On an external scope where stealth isn’t a concern, let it rip.

One more that’s saved me on long-running scans. If EyeWitness gets interrupted for any reason, you can resume where you left off using the database file it creates during the scan.

On an Internal Assessment

This is where EyeWitness really shines. Internal networks are messy. There are hundreds of web services running on all kinds of ports and most of them were set up years ago by someone who doesn’t work there anymore. That’s where you find the gold.

Picture this. You’re on an internal assessment and you’ve finished your initial network scans. You’ve got 600+ web servers. Rather than spending half a day clicking through each one, you send your Nmap results directly into EyeWitness. Twenty minutes later, you’ve got a report. You scroll through and immediately spot a Tomcat manager page with default credentials, a Jenkins instance wide open, and a network appliance login page that hasn’t been updated since 2015. That’s three potential footholds identified in the time it would’ve taken you to manually check maybe twenty sites.

The report categories make triage fast. I usually start with the High Value Targets section, then check IDRAC/ILO management interfaces, then directory listings, then anything flagged with default creds. That order has consistently gotten me to the interesting stuff fastest. The directory listings alone have been responsible for more “oh no” moments in client debriefs than I can count. People forget what they’ve left exposed on internal web servers.

I’ve lost count of how many times EyeWitness has pointed me at default creds on a management interface, an exposed admin panel, or a forgotten dev server with directory listing enabled. It finds the stuff that’s easy to miss when you’re dealing with scale.

On an External Assessment

External assessments are a different game. Your target list is usually smaller but the stakes on each finding are higher. Everything is internet-facing, so anything you find is something an attacker anywhere in the world could find too.

We’ll typically start by feeding in a list of subdomains from OSINT/recon. A lot of those will be bare hostnames without a protocol, so –prepend-https is almost always part of the command. Combined with a custom user-agent so the client’s WAF doesn’t immediately block you.

On external scopes I’m looking for different things than internal. Forgotten staging environments that are still publicly accessible. Test servers with debug mode enabled. Legacy applications that haven’t been patched because nobody remembers they exist. Marketing microsites running WordPress with default admin credentials. All of that shows up in the EyeWitness report if it’s there.

We have had external assessment at Red Siege where EyeWitness found a portals that clients had long forgotten about, or thought were de-commissioned… and on some of them was stuff so juicy that it alone almost justified the entire assessment and it took about thirty seconds to spot in the report.

For Defenders

For defenders, EyeWitness is just as useful. Run it against your own infrastructure and see what an attacker would see. If there are default credentials on anything in your environment, you want to find them before someone like me does. Schedule it as a regular scan against your internal ranges and your external footprint. New services pop up all the time, and the ones that nobody told security about are usually the ones with problems.

Pay special attention to the directory listings and management interfaces. Those are consistently the findings that lead to the worst outcomes on our assessments. An exposed IDRAC interface or a forgotten Tomcat manager page is often all it takes to go from outside the network to full domain compromise.

EyeWitness is free, open source, and actively maintained. Grab it from the Red Siege GitHub and make your recon phase a whole lot less painful.