Listen to this Post
Introduction:
The reconnaissance phase in bug bounty hunting and penetration testing is often a monotonous yet critical process, involving sifting through thousands of subdomains to identify low-hanging fruit. Manual verification is time-prohibitive, creating a significant bottleneck. The WebShot Tool v4.0, developed by Puniyat Jangir, addresses this directly by automating screenshot capture, tech stack fingerprinting, and endpoint discovery, transforming raw subdomain lists into actionable intelligence.
Learning Objectives:
- Understand how to automate the reconnaissance and information-gathering phase of a security assessment.
- Learn to integrate and utilize tools like Playwright for browser automation and BeautifulSoup for HTML parsing in a security context.
- Develop the skills to analyze automated reports to quickly prioritize targets based on status codes and exposed panels.
You Should Know:
1. Tool Installation and Setup
Before leveraging automation, you must correctly set up the environment. This involves cloning the repository and installing its Python dependencies.
Clone the repository git clone https://github.com/puniyat/webshot-tool.git cd webshot-tool Install Python dependencies using pip pip install -r requirements.txt Install Playwright browsers playwright install
Step-by-step guide:
The `git clone` command fetches the latest version of the tool from its GitHub repository. Installing the `requirements.txt` file ensures all necessary Python libraries, such as `playwright` and beautifulsoup4, are present. Finally, `playwright install` downloads the headless browser binaries (Chromium, Firefox, WebKit) required to take screenshots.
2. Basic Tool Execution
The core function of the tool is processing a list of URLs. You provide a file containing subdomains, and the tool handles the rest.
Basic execution with an input file python3 webshot.py -i subdomains.txt -o report.html Using a thread pool for faster processing python3 webshot.py -i subdomains.txt -o report.html -t 50
Step-by-step guide:
The `-i` flag specifies the input file, which should contain one subdomain (e.g., admin.example.com) per line. The `-o` flag defines the name of the output HTML report. The `-t` flag sets the number of threads; increasing this number (e.g., to 50) parallelizes the work, drastically speeding up the processing of large lists.
3. Deep Crawling for Endpoint Discovery
To move beyond the root page, the tool can crawl linked pages to discover hidden endpoints, a common source of critical vulnerabilities.
Execute with a crawl depth of 2 python3 webshot.py -i subdomains.txt -o deep_report.html --depth 2
Step-by-step guide:
The `–depth` flag instructs the tool’s internal crawler to follow links from the initial page. A depth of 1 visits all links on the root page. A depth of 2 will follow links on those subsequent pages as well. This is invaluable for discovering administrative panels (/admin), API endpoints (/api/v1/users), and backup files that are not linked from the main index.
4. Generating Target Lists from Recon Data
After generating the report, you can use standard command-line tools to parse logs or output files to create highly specific target lists.
Extract all URLs that returned a 403 (Forbidden) status code
grep "403" webshot_log.txt | awk '{print $2}' > 403_targets.txt
Find all domains running a specific technology (e.g., WordPress)
grep -i "wordpress" report.html | awk -F'>' '{print $2}' | awk -F'<' '{print $1}' > wordpress_targets.txt
Step-by-step guide:
The first command uses `grep` to filter lines containing “403” from a hypothetical log file and `awk` to extract just the URL, saving them to a new file. These 403 endpoints are prime targets for forced browsing attacks. The second command parses the HTML report for a specific tech stack, allowing a bug hunter to focus on technologies they are most familiar with.
5. Windows PowerShell Integration for Target Management
On a Windows machine, you can use PowerShell to prepare and manage your target lists before feeding them to WebShot.
Combine multiple subdomain list files, remove duplicates
Get-Content .\list1.txt, .\list2.txt, .\list3.txt | Sort-Object -Unique > .\final_subdomains.txt
Filter for only live domains using a simple HTTP status check (requires Invoke-WebRequest)
Get-Content .\final_subdomains.txt | ForEach-Object { try { if ((Invoke-WebRequest -Uri "http://$_" -TimeoutSec 5 -DisableKeepAlive).StatusCode -eq 200) { $_ } } catch {} } > live_targets.txt
Step-by-step guide:
The first commandlet reads multiple input files, sorts the content, and removes duplicate entries, creating a clean list. The second, more advanced script attempts a quick HTTP request to each subdomain and only outputs those that respond with a 200 status code, creating a pre-verified list of active targets for WebShot.
6. Validating Tool Findings with cURL
Once the report highlights interesting endpoints (like login panels), manually verify them with `cURL` to inspect headers and response bodies.
Inspect the headers and response of a login panel curl -I http://admin.target.com/login curl -s http://admin.target.com/login | grep -i "title|h1" Test for HTTP Verb Tampering on a 405 endpoint curl -X POST http://api.target.com/v1/users -I
Step-by-step guide:
The first `curl -I` command fetches only the HTTP headers, which can reveal the server type and potential vulnerabilities. The second command fetches the page body and searches for page titles or headings. The third command tests an alternative HTTP method (POST) on an endpoint, which might bypass security controls that only block GET requests.
7. Mitigation: Hardening Web Applications Against Automated Recon
From a defensive perspective, understanding this tool’s methodology allows you to protect your assets. Implement measures in your `nginx.conf` or `.htaccess` to slow down scanners.
Nginx rule to slow down excessive requests from a single IP
limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
location / {
limit_req zone=one burst=5 nodelay;
}
Block requests from common automated scanner User-Agents
if ($http_user_agent ~ (wget|curl|python|nikto|dirb) ) {
return 403;
}
Step-by-step guide:
The first block defines a rate-limiting zone that allows only 1 request per second from a single IP address, with a small burst allowance. This drastically slows down automated tools. The second block checks the User-Agent string for common command-line tools and scanners, returning a 403 Forbidden error if detected. Note that this can be bypassed by changing the User-Agent but adds a layer of defense.
What Undercode Say:
- The Bar for Entry-Level Recon is Now Higher: Tools like WebShot v4.0 democratize advanced reconnaissance, allowing newcomers to perform deep, automated scans that were previously the domain of experienced practitioners with custom scripts. This raises the baseline skill required for effective bug hunting.
- Defenders Must Assume They Are Constantly Being Probed: The efficiency of this tool underscores that any public-facing asset is continuously enumerated. Defensive strategies can no longer rely on “security through obscurity” and must include robust logging, monitoring, and rate-limiting to detect and impede such automated reconnaissance activities.
The proliferation of free, open-source, and highly effective tools like WebShot signifies a paradigm shift. For attackers, it commoditizes the initial phases of an attack, making widespread scanning effortless. For defenders, it means their external attack surface is under more constant and sophisticated scrutiny than ever before. The focus for security teams must shift from hoping they aren’t seen to assuming they are already found and hardening their assets accordingly.
Prediction:
The automation of reconnaissance will rapidly evolve from subdomain enumeration to fully integrated attack chains. We predict the next generation of such tools will not only identify targets but also automatically launch tailored, low-risk exploitation attempts against common vulnerabilities (e.g., testing for default credentials on identified admin panels or probing for specific API misconfigurations). This will compress the time between target discovery and initial compromise from days to minutes, forcing the adoption of fully automated defense-in-depth and AI-powered security monitoring solutions.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Puniyatjangir Excited – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
