fbpx

EyeWitness – A Rapid Web Application Triage Tool

We, at ehacking
used to share
tools that can make the penetration testing process easy
and effective. You might have seen EH Tools shared before and you will witness
the tools that we will share later, but today I have an interesting tool to
discuss; it’s called EyeWitness. Chris Truncer is the man behind this tool; it
has been designed to run on Kali Linux.








EyeWitness is
designed to take screenshots of websites, provide some server header info, and
identify default credentials if possible.

 EyeWitness is designed to take a file, parse
out the URLs, take a screenshot of the web pages, and generate a report of the
screenshot along with some server header information.  EyeWitness is able
to parse three different types of files, a general text file with each url on a
new line, the xml output from a NMap scan, or a .nessus file.  Jason Hill (
@jasonhillva)
worked on creating the XML parsing code for EyeWitness, and provided a lot of
feedback throughout writing it. 

In addition to
providing the file name, you can also optionally provide a maximum timeout
value.  The timeout value is the maximum amount of time EyeWitness waits
for a web page to render, before moving on to the next URL in the list.

Image Credit

Supported Linux Distros:
Debian
7+ (at least stable, looking into testing) (Thanks to @themightyshiv)
CentOS
6.5+ (Thanks to @themightyshiv)
Setup:
1.   
Navigate into the setup
directory
2.   
Run the setup.sh script
Usage:
./EyeWitness.py
-f filename -t optionaltimeout –open (Optional)
Examples:
./EyeWitness
-f urls.txt
./EyeWitness
-f urls.xml -t 8 –open

Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

What are Online Casinos doing to be as Safe and Secure as Possible?

Online casinos have continued to increase in popularity over recent years as more and more gamblers have turned to virtual options to further enhance...

Reconnaissance for Bug Bounty Hunters & Pentesters

New to the bug bounty and confused about where to start? Worry not! This reconnaissance for bug bounty hunters guides you to take the...

Access & Manage Android Phone Remotely – L3MON Tutorial

There is software available, like Metasploit, to gain remote access to any android phone. But other than that, we have the L3MON tool (A...

How to Hide Shellcode Behind Closed Port?

Every company has a variety of scanners for analyzing its network and identifying new or unknown open ports. It's unthinkable to disguise the potentially...