gowitness drives headless Chrome to take a screenshot of every web page you point it at. Give it one URL, a text file of hosts, a CIDR range, or an Nmap or Nessus export, and it visits each one on ports 80 and 443 (or the ports you choose), saves a screenshot, and can record the response headers, cookies, console messages, a network log, the TLS certificate and the technologies it recognises from the Wappalyzer dataset. Results go to SQLite, MySQL, PostgreSQL, JSON lines or CSV, and a built-in report server turns a SQLite file into a searchable gallery with a REST API.
The point is triage at a glance. After a discovery step turns up a few hundred hosts, scrolling a wall of thumbnails is the fastest way to spot the forgotten admin panel, the default install page or the login screen that should not be public. Screenshots carry a perceptual hash, so the gallery can sort look-alike pages together and a hundred identical parking pages sit in one run instead of scattered through the list.
It comes from SensePost, the offensive security team at Orange Cyberdefense, and is written by Leon Jacobs. Version 3, released in 2024, rebuilt it with a new React report viewer and API. The project has about 4,550 stars, 46 contributors and 46 releases since 2017; 3.2.2 shipped on 11 October 2026 and the last push was on 21 October. It is GPL-3.0 licensed.
- Repository: github.com/sensepost/gowitness
- Licence: GPL-3.0 (GNU General Public License v3.0)
- Language: Go. Stars: 4,550. Forks: 456. Last push: Oct 21, 2026.
- Scan: safe, Oct 28, 2026, commit 601c843
Who it is for
Penetration testers and red teams on an authorised engagement, bug bounty hunters working through an in-scope host list, and IT or security teams who want a visual inventory of every web interface on their own network.
Getting started
1. Install with Go (release binaries and a ghcr.io/sensepost/gowitness Docker image also exist)
go install github.com/sensepost/gowitness@latest2. Screenshot one site and save the result to a SQLite database
gowitness scan single --url "https://example.com" --write-db3. Screenshot every host in a file
gowitness scan file -f targets.txt --write-db4. Browse the results in the report viewer on http://127.0.0.1:7171
gowitness report servergowitness needs Chrome or Chromium. It uses the copy it finds on your system, and the go-rod driver downloads its own Chromium build if it finds none. Every scan loads real pages, so only point it at hosts you own or are allowed to test.
Safety scan
We cloned sensepost/gowitness at commit 601c843 on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no pattern hits, no install hooks and no committed binaries across 156 files and about 15,000 lines of Go and TypeScript. The handful of hosts the scan lists are documentation links and SensePost's own site, used as the example target.
- The report server binds to 127.0.0.1:7171 by default and has no authentication. Its API can list, search and delete results and submit new URLs to scan, so if you pass --host 0.0.0.0, anyone who can reach the port can use your machine to load pages. Put it behind a VPN or an authenticating proxy if you share it.
- go.mod pins 92 packages with 8 advisories: seven unrated golang.org/x/net HTTP/2 issues and one moderate chi issue with client IPs read from X-Forwarded-For. None is critical or high, and both mostly matter for a server exposed to the internet, which this one is not by default.
- web/ui/package-lock.json, the report viewer's React build, has 8 advisories, 2 high. The Vite ones affect only the development server, which never ships; the Zod one is a memory exhaustion bug when validating oversized input, in a viewer that only reads your own scan data.
- Two workflows, no pull_request_target. The 7 third-party action uses are pinned to tags, not commits. Licence present; no security policy, contributing guide, Dependabot or CodeQL, which fits a project maintained by a small team.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 2 workflows. None use pull_request_target. 7 of 7 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 6 distinct hosts referenced from source; most often github.com, sensepost.com, chromedevtools.github.io, chromium.googlesource.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 16 advisories across 438 pinned packages: 0 critical, 2 high, 6 moderate, 1 low, 7 unrated. go.mod: 92 packages, 8 advisories; web/ui/package-lock.json: 348 packages, 8 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | 3.9 out of 10, as of Oct 26, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Worst known vulnerabilities (16 of 16)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-587h-7wmj-h5pm | high | vite@8.3.2 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
| GHSA-mrhx-c7xc-m3w5 | high | zod@4.6.5 | Zod can exhaust memory while validating oversized constrained collections |
| GHSA-j6qf-3m9c-vwj3 | moderate | github.com/go-chi/chi/v5@5.3.2 | chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For |
| GHSA-rj75-hqrm-r3gf | moderate | postcss-selector-parser@6.1.4 | PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion |
| GHSA-698v-4r3x-3vcv | moderate | vite@8.3.2 | launch-editor: escapeCmdArgs() omits % escaping on Windows |
| GHSA-r825-w8mm-5pxw | moderate | vite@8.3.2 | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
| GHSA-rq7h-c2jc-7f22 | moderate | vite@8.3.2 | Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
| GHSA-vfpm-58rq-9qcg | moderate | vite@8.3.2 | Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` |
| GHSA-9jrq-w75r-8gcw | low | vite@8.3.2 | Vite: Cross origin script execution through Vite custom middleware |
| CVE-2026-78659 | unknown | golang.org/x/net@0.59.0 | HTTP/2 server memory exhaustion due to Trailer headers in net/http |
| CVE-2026-78660 | unknown | golang.org/x/net@0.59.0 | HTTP/2 transport accepts malformed framing-related headers in net/http |
| CVE-2026-78669 | unknown | golang.org/x/net@0.59.0 | Excessive CPU consumption from repeated initial window changes in net/http |
| CVE-2026-78663 | unknown | golang.org/x/net@0.59.0 | Double flow control refund on HTTP/2 server streams in net/http |
| CVE-2026-97032 | unknown | golang.org/x/net@0.59.0 | HTTP/2 server crash due to HPACK encoder race in net/http |
| CVE-2026-78661 | unknown | golang.org/x/net@0.59.0 | Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net |
| CVE-2026-97045 | unknown | golang.org/x/net@0.59.0 | Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net |
By the numbers
| Stars | 4,550 |
|---|---|
| Forks | 456 |
| Contributors | 46 |
| Commits | 524 |
| Open issues | 28 |
| Open pull requests | 11 |
| Releases | 46 |
| Latest release | 3.2.2 |
| Licence | GPL-3.0 |
| Main language | Go |
| Project age | 8 years |
| Last push | Oct 21, 2026 |
| Tracked files | 156 |
| Lines of code | 15.1K |
| Checkout size | 7 MB |
Lines by language: Go 7,936, TypeScript 4,951, JSON 1,040, YAML 841, Markdown 131, JavaScript 100.
Questions
Is gowitness free?
Yes. gowitness is GPL-3.0 licensed and free to use, including at work and on paid engagements. If you modify it and distribute the result, the GPL asks you to share your changes under the same licence. SensePost offers other terms on request.
Is it legal to screenshot websites with gowitness?
Loading a public web page is what a browser does, but sweeping a whole IP range or a list of someone else's hosts can break terms of service or computer misuse laws. Use gowitness on your own infrastructure, on a client's systems with written permission, or inside a bug bounty programme's published scope.
Can gowitness read Nmap or Nessus results?
Yes. gowitness scan nmap takes an Nmap XML file and can keep only open ports or particular services, and gowitness scan nessus does the same for a Nessus export. gowitness scan cidr expands an IP range, and gowitness scan file reads a plain list, including from stdin.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.