Why My Pentesters Take Pictures of Your Network

When people picture a penetration test, they usually imagine a figure in a hoodie, fingers flying across a glowing keyboard, knocking down firewalls in real time. Anyone who has actually run an engagement will tell you the reality is less cinematic and more methodical. The first hours of a test rarely involve breaking anything. They involve looking.

Jason Taylor, a Lead Penetration Tester at Raxis, recently posted a walkthrough on the Raxis blog covering a tool we lean on heavily for exactly that kind of looking. It is called GoWitness, and I want to add a little color to his post because it captures something important about how modern penetration testing actually works.

The Bottleneck Nobody Talks About

A typical internal network test starts with a scan that returns hundreds of live web services.

· Default admin panels

· Forgotten developer dashboards

· Printer management pages

· Misconfigured Tomcat instances

· Half installed WordPress sites left over from a project nobody finished

Every one of those services is a potential foothold, and every one of them deserves a look.

The problem is human attention. Clicking through a thousand URLs in a browser is not a strategy. It is a way to lose a day. Worse, it is a way to miss the one ESXi login page sitting between two duplicates of an IIS welcome screen.

This is the bottleneck GoWitness solves.

What GoWitness Actually Does

GoWitness is a small command line utility that visits a list of URLs and saves a screenshot of each one. Then it lays them out in a browsable gallery so your tester can scan visually instead of clicking blindly.

Jason walks through the full workflow in his post, but the headline commands look like this:

apt install gowitness
gowitness scan file -f <filename> - write-db
gowitness report server

apt install gowitness
gowitness scan file -f <filename> - write-db
gowitness report server

That third line spins up a local web server on port 7171 with a clean gallery view of every site GoWitness captured. From there our team can spot the interesting hosts in seconds. A Grafana dashboard here, a default Apache page there, a forgotten Jenkins instance over in the corner. The human eye works faster than any wordlist.

Why a CEO Cares About a Screenshot Tool

You might wonder why the person who signs the contracts is writing about a recon utility. Two reasons.

The first is that the quality of a penetration test is decided in the first day, not the last. If our testers do not see the full attack surface, they cannot test it. Tools that compress hours of triage into minutes give us more time on the work that actually matters, which is finding the issues that put our clients at risk.

The second is that this kind of tooling is a window into how a good pentest is run. When a customer asks what they are paying for, the honest answer is judgment. The tools are mostly free. The skill is in knowing which screenshot to ignore and which one is the front door to your domain controller.

Field Tips Worth Stealing

If you are a pentester reading this, Jason's post has a few small habits worth picking up. Let's start with directory discipline. Before each scan, create a fresh working directory and run GoWitness from inside it. When you are juggling various subnets, separated results are the difference between a clean report and a confused one.

The Group by Similar button in the gallery is another quiet hero. It collects every default IIS page right next to each other so you can move on to the hosts that are actually different. Each type of web interface gets its own section ready for triage.

Finally, if you are operating against an internal network from a remote attack box, do not expose the GoWitness dashboard. Tunnel it. A SOCKS proxy over SSH with the -ND flag, paired with FoxyProxy in Firefox pointed at http://localhost:7171, is the simple answer.

Read the Original

I am biased about this, but I think Jason's full post is worth your time. It includes the screenshots and configuration details that make the workflow easy to copy on your next engagement.

If you are a pentester, take it as a small upgrade to your daily kit. If you are someone who hires pentesters, take it as a peek at the unglamorous, high leverage work your testers are doing in the first hours of every engagement. The flashy exploits get the headlines. The quiet recon gets the wins.

Want more posts like this? The Raxis team writes regularly about the tools, tactics, and lessons we pick up in the field. Come find us at raxis.com/blog.