Aquatone
MIT๐ธ Web Scanning ยท Go
Aquatone is a tool for visual inspection of websites across a large number of hosts, designed to help quickly identify interesting targets in a sea of web servers. Given a list of URLs or domains, Aquatone visits each one, takes a screenshot, collects HTTP headers and response bodies, and generates an interactive HTML report that lets you visually browse through all discovered web services. This visual approach is much faster than manually visiting hundreds of URLs - you can quickly spot login panels, default pages, interesting applications, and potential targets by scanning through the screenshot gallery. Aquatone is commonly used after subdomain enumeration to triage discovered assets, identifying which subdomains host web applications worth deeper investigation. It runs headless Chrome for rendering and supports customizable viewport sizes, timeouts, and concurrent connections.
Installation
Go
$ go install github.com/michenriksen/aquatone@latestDownload
$ Download pre-built binary from GitHub releasesUse Cases
- Triaging hundreds of discovered subdomains by visual inspection of screenshots
- Generating browsable HTML reports of web services across an attack surface
- Identifying login panels, admin interfaces, and default pages at scale
- Visual diffing of web services between assessment periods to spot changes
- Screening web servers for interesting applications after reconnaissance
Tags
Details
- Category
- ๐ธ Web Scanning
- Language
- Go
- Repository
- michenriksen/aquatone
- License
- MIT
- Platforms
- ๐งlinux๐macos๐ชwindows
Links
Alternatives & Comparisons
More in Web Scanning
httpx
GoFast multi-purpose HTTP toolkit. Probes for running HTTP servers with retries and fallbacks.
Nikto
PerlClassic web server scanner. Tests for dangerous files, outdated server software, and version-specific problems.
Gobuster
GoDirectory/file, DNS, and vhost busting tool. Brute-forces URIs, DNS subdomains, virtual host names, and S3 buckets.
Feroxbuster
RustFast, recursive content discovery tool written in Rust. Like gobuster on steroids with auto-recursion.
Burp Suite Community
JavaWeb vulnerability scanner and proxy. Intercept, modify, and replay HTTP/S traffic for web app testing.
ffuf
GoFast web fuzzer written in Go. Fuzz anything - URLs, headers, POST data - with blazing speed.