Getting a visual on your network with Eyewitness

Whether assessing your security posture, hunting for vulnerable targets, or just taking inventory, Eyewitness will give you a visual of what’s active on your network.

Eyewitness is a Python tool that takes screenshots of websites, gathers header information, and displays default credentials (if possible). This is especially useful when scouring your network for web-based applications or devices. Let’s take a look at how this works.

First off, we’ll need to install Eyewitness. We can do this by running the following command:

Now that we have the application installed, let’s give it something to work with. We can do this by running Nmap and searching for open http ports ( — open -p). We’ll then output the results to an xml file (-oX), let’s call it scan.xml

As you can see from the output, we’ve found three instances of http running on the network. Next, we’ll run eyewitness against the xml file we just created with Nmap.

Eyewitness now attempts to access each of those HTTP services and take a screenshot of the default screen.

Once complete, type Y to open the web report, which is stored locally on your system for future analysis.

Take a look at that. We have a nice html-based report that shows us everything Nmap found. This report displays images of the default web pages and provides some additional header info about the web server being used.

This is a great way to inventory a network and see what is running in terms of web-based services. Above, I’m displaying a generic web server splash page, but you’ll find all sorts of interesting stuff in your scans (routers, printers, cameras, etc).

Whether you’re footprinting a network for recon or inventorying what’s on your home network, Eyewitness is a pretty cool tool that can give you a pretty good visual of what’s going on in terms of web accessible devices. Give it a try for yourself.

Related posts:

Como primera propuesta para el reportaje, sería el revuelo que se ha causado por el campo de futbol de Calpe que lleva inhabilitado durante 5 meses y el Club se ha tenido que trasladar a otras…