gowitness

Gowitness

Purpose

Use this skill to add fast visual context to a confirmed web inventory.

Phase Fit

• Primary: Discovery and Reconnaissance
• Secondary: Threat Modeling and Test Planning
• Retest use: confirm that a risky interface is no longer exposed or has changed as expected

Use When

• Need a human-friendly view of exposed web assets.
• Need to identify admin interfaces, default pages, or stale portals quickly.
• Need screenshots as clean report evidence.

Avoid When

• No confirmed web surface exists.
• Capturing screenshots would expose sensitive data unnecessarily.

Inputs

• Confirmed web URLs from httpx or known inventory
• Screenshot retention and redaction requirements

Procedure

1. Capture only approved and confirmed URLs.
2. Review screenshots for login portals, admin pages, and obvious segregation mistakes.
3. Tag high-value targets for manual review in burp-suite.
4. Use the visual set to refine the test plan and reporting narrative.
5. Redact or separate any sensitive captures before sharing.

Command Syntax

Replace sample targets with approved in-scope assets. Syntax can vary by version.

# Screenshot a single target
gowitness scan single --url https://portal.contoso.com

# Screenshot from a list of live URLs
gowitness scan file -f contoso-live.txt

# Scan a CIDR range on port 443
gowitness scan cidr --cidr 10.10.10.0/24 --port 443

# Set resolution and timeout
gowitness scan file -f contoso-live.txt --timeout 15

# Generate HTML report from captured screenshots
gowitness report generate

Evidence to Capture

• Screenshots tied to exact URLs and timestamps
• Administrative or unexpected interfaces
• Visual confirmation of decommissioning drift or stale exposure

Safety Boundaries

• Minimize screenshot capture of sensitive user data.
• Keep evidence handling aligned with the engagement's data rules.