EyeWitness and Aquatone: Triage 500 Hosts in Under 10 Minutes

0s6 min★ 20 XP

Lesson 3Interactive lesson

EyeWitness and Aquatone: Triage 500 Hosts in Under 10 Minutes

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format14 sections2 code blocks1 practice itemUpdated Aug 27, 2026

#Screenshots Beat Scrolling Through 500 IPs#link

You just ran Nmap against a /16 and got 340 hosts with web services. Opening each one in a browser is not a methodology. EyeWitness and Aquatone solve this by screenshotting every web service and assembling an HTML report you can triage visually.

Running EyeWitness against Nmap XML

EyeWitness with Nmap XML input

root@vulnarex:~#eyewitness --web -x web_discovery.xml -d inlanefreight_eyewitness

EyeWitness categorizes results automatically. High Value Targets appear first—Tomcat managers, Jenkins consoles, admin panels. It fingerprints applications and suggests default credentials. For a 26-host scope, this saves an hour. For 500 hosts, it saves a day.

Aquatone as an alternative

Aquatone with Nmap XML piped in

root@vulnarex:~#cat web_discovery.xml | ./aquatone -nmap

Aquatone also accepts Masscan XML and plain text host lists. It clusters similar pages, which helps you spot the one Joomla instance among twenty identical IIS default pages. The HTML report opens in any browser—no dependencies needed on the review side.

What to look for in the report

Tomcat on any assessment means try default credentials on /manager and /host-manager immediately. A support portal running osTicket means potential email address harvesting. A GitLab instance means check for open registration and public repos. Custom applications with file upload buttons mean test unrestricted upload.

callout

During an external pentest, a ManageEngine OpManager instance was found buried deep in a massive EyeWitness report. Default credentials admin:admin. The application ran as Domain Admin. Full internal compromise from one overlooked screenshot on page 47.

★ 20 XP

quiz BLOCK (★ 20 XP)

What input format does EyeWitness accept that Aquatone does NOT?

Select your proof vectors above

Don't start attacking hosts the moment you see them. Complete the entire report review first. Note every interesting host with URL, application name, and version. Then attack systematically. Rabbit holes kill engagements.

STRICT SECURE AUDIT RULE

EyeWitness reports in large environments can exceed 500 pages. Interesting hosts get buried. Review the entire report. The OpManager find on page 47 proved that.

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 20 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

Screenshots Beat Scrolling Through 500 IPs

Content

Last updated

August 27, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "/api/content/lessons?courseSlug=attacking-common-applications&lessonSlug=03-eyewitness-aquatone&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.