repository·master·Indexed 27 days ago
https://github.com/michenriksen/aquatoneAquatone is a tool for visual inspection of websites across a large number of hosts, providing an overview of an HTTP-based attack surface through screenshots and header analysis. It supports piping targets from other tools, parsing Nmap or Masscan XML input, and generating HTML reports based on session data.
Aquatone is primarily used by piping the output of other tools (containing URLs, domains, or IP addresses) into the aquatone command. It uses regular expression pattern matching to extract targets.
If the input contains IPs or hostnames, Aquatone scans them for web service ports. If the input contains full URLs, they are assumed to be alive and are not scanned for ports.
cat targets.txt | aquatoneTo install Aquatone, follow these steps:
aquatone binary to a location in your $PATH for easier use.By default, Aquatone writes files to the current directory. You can change this in two ways:
-out flag for a specific execution.AQUATONE_OUT_PATH environment variable to define a permanent default destination.If you provide a path to an existing Aquatone session file using the --session-path option (implied by sess.Options.SessionPath), Aquatone will skip the scanning process and instead generate an HTML report from the session data.
You can also specify a custom HTML template using the --template-path option. If no template is provided, the default static/report_template.html is used. The resulting report is saved as aquatone_report.html within your specified output directory.
After processing, Aquatone generates the following files and directories:
aquatone_report.html: HTML report displaying screenshots and response headers clustered by similarity.aquatone_urls.txt: List of all responsive URLs.aquatone_session.json: Statistics and page data (useful for automation).headers/: Folder containing raw response headers.html/: Folder containing raw response bodies. (Disable with -save-body=false to save space).screenshots/: Folder containing PNG screenshots.Aquatone provides several flags to control its behavior:
| Flag | Description |
|---|---|
-chrome-path string | Full path to the Chrome/Chromium executable. Default: searches for Chrome or Chromium |
-debug | Print debugging information |
-http-timeout int | Timeout in milliseconds for HTTP requests (default: 3000) |
-nmap | Parse input as Nmap/Masscan XML |
-out string | Directory to write files to (default: . ) |
-ports string | Ports to scan (aliases: small, medium, large, xlarge; default: 80,443,8000,8080,8443) |
-proxy string | Proxy to use for HTTP requests |
-resolution string | Screenshot resolution (default: 1440,900) |
-save-body | Save response bodies to files (default: true) |
-scan-timeout int | Timeout in milliseconds for port scans (default: 100) |
-screenshot-timeout int | Timeout in milliseconds for screenshots (default: 30000) |
-session string | Load Aquatone session file and generate HTML report |
-silent | Suppress all output except for errors |
-template-path string | Path to HTML template to use for report |
-threads int | Number of concurrent threads (default: number of logical CPUs) |
-version | Print current Aquatone version |
Aquatone scans for web services on target hosts. You can specify custom ports using the -ports flag or use built-in aliases for common port sets.
Port Aliases:
small: 80, 443medium: 80, 443, 8000, 8080, 8443 (default)large: 80, 81, 443, 591, 2082, 2087, 2095, 2096, 3000, 8000, 8001, 8008, 8080, 8083, 8443, 8834, 8888xlarge: A very large list of common web ports (see documentation for full list).cat hosts.txt | aquatone -ports largeIf you are providing XML output from Nmap or Masscan, use the -nmap flag to instruct Aquatone to parse the input correctly.
cat scan.xml | aquatone -nmapstdin. The parsing logic depends on the following configuration: