Introduction
At this stage, you already have:
- Subdomains
- Live hosts
- URLs and endpoints
Now the problem is different.
You have too many targets.
If you try to manually open each one, you will waste hours.
This is where visual recon becomes powerful.
Instead of reading everything,
you see patterns instantly.
Why visual recon matters
- Humans detect patterns faster visually
- Screenshots reveal hidden panels quickly
- You can group similar apps in seconds
- Helps identify high-value targets faster
Good recon is not about more data. It is about faster understanding.
What you are trying to do
- Take screenshots of all live hosts
- Identify interesting interfaces
- Group similar applications
- Spot anomalies quickly
This becomes your fast triage layer.
Tools you will use
- httpx (with screenshot option)
- Aquatone
- Eyewitness
- gowitness (optional modern alternative)
All tools do similar things:
Capture screenshots and metadata.
Step-by-step visual recon workflow
1. Prepare your live hosts list
You already have:
live_hosts.txt
Make sure it contains:
- Only working hosts
- Clean and deduplicated
2. Quick screenshots using httpx
Fastest way:
httpx -l live_hosts.txt -screenshot -title -tech-detect -o visual.txt
What this gives
- Screenshot files
- Page titles
- Technologies
This is your first visual overview.
3. Using Aquatone (classic and powerful)
cat live_hosts.txt | aquatone
Output includes:
- Screenshots
- Categorised pages
- HTTP metadata
Aquatone groups similar responses automatically.
Very useful.
4. Using Eyewitness
eyewitness --web -f live_hosts.txt --threads 20
What it does
- Takes screenshots
- Generates HTML report
- Categorises results
Good for structured reports.
Understanding screenshot output
Now comes the real skill.
You are not just looking.
You are filtering mentally.
What to look for in screenshots
High-value indicators
- Admin dashboards
- Login panels
- Internal tools
- APIs with responses
- Debug pages
- Monitoring dashboards
Examples:
- “Admin Panel”
- “Dashboard”
- “Internal Service”
These go to top priority.
Medium-value indicators
- Marketing pages
- Static sites
- Documentation
Useful but not urgent.
Low-value indicators
- CDN error pages
- Blank responses
- Repeated templates
Ignore quickly.
Pattern recognition (important skill)
You will see repeated designs.
Example:
- Same login page across 10 subdomains
- Same API response
- Same dashboard
This means:
- Same backend
- Same vulnerability surface
Test one deeply instead of all.
Grouping similar targets
Group hosts based on:
- Title
- Layout
- Response pattern
Example grouping:
Group 1
- admin.example.com
- admin-dev.example.com
Group 2
- api.example.com
- api-stage.example.com
Now testing becomes easier and faster.
Finding anomalies (this is where bugs hide)
Look for:
- Different UI than others
- Error messages
- Debug info
- Incomplete pages
Example:
- One subdomain shows stack trace
- One shows internal API
These are gold.
Combining visual recon with previous data
Use screenshots along with:
- URL data
- DNS info
- JS endpoints
Example:
- Screenshot shows admin panel
- JS reveals
/api/admin - Now you have a clear attack path
This is how chaining works.
Speed triage workflow
Follow this flow:
- Scan screenshots quickly
- Mark interesting ones
- Ignore duplicates
- Group similar targets
- Pick top 5–10 targets
- Go deep
This saves hours.
Real-world use-cases
- Finding exposed admin panel visually
- Spotting internal tools by UI
- Identifying staging apps quickly
- Finding debug interfaces
- Detecting misconfigured dashboards
These are very common wins.
Mini lab exercise (20-30 minutes)
- Use your live hosts list.
- Run:
httpx -l live_hosts.txt -screenshot -title -silent
- Open screenshot folder.
- Do quick scan:
- Pick 5 interesting targets
- Ignore rest
- Write notes:
- Why each is interesting
- What you will test next
This builds visual filtering skill.
Common mistakes and fixes
Mistake: Trying to manually open every host
Fix: Use screenshots
Mistake: Not grouping similar apps
Fix: Cluster by pattern
Mistake: Ignoring visual anomalies
Fix: Focus on differences
Mistake: Over-analyzing low-value targets
Fix: Prioritise quickly
Quick command summary
httpx screenshots:
httpx -l live_hosts.txt -screenshot
Aquatone:
cat live_hosts.txt | aquatone
Eyewitness:
eyewitness --web -f live_hosts.txt
What to do after this Part
- Pick high-value targets
- Start parameter testing
- Analyse APIs
- Move into vulnerability discovery
Now your recon is focused and sharp.
Next post preview
Part 13 – JavaScript and Frontend Recon (Endpoints, Secrets, Logic)
We will cover:
- Extracting endpoints from JS
- Finding hidden APIs
- Analysing frontend logic
- Detecting client-side vulnerabilities
This is where hidden attack surface explodes.
Closing thought
Speed matters.
But direction matters more.
Visual recon gives you both.
Disclaimer
This content is for educational purposes only. Use it ethically and only against targets you own or have explicit permission to test. Do not use any techniques described here in ways that break laws, platform rules, or third-party rights. If in doubt, stop and get permission.
