Course #217: Mastering gowitness$
# Course #217: Mastering gowitness$## Section 5: Mastering gowitness$### Introduction to gowitness$In today's web-centric world, security assessments against web applications have become crucial for ensuring the integrity and confidentiality of data. One of the indispensable tools for web application reconnaissance is **gowitness**. This tool allows penetration testers to capture screenshots of web pages, gather metadata, and perform various reconnaissance tasks efficiently.In this final section, we delve into the installation and configuration of gowitness on Kali Linux, explore its usage through step-by-step instructions, and illustrate real-world use cases. This guide is designed for advanced users who wish to master gowitness and integrate it into their penetration testing workflow.—### 1. Installation and Configuration on Kali LinuxKali Linux comes pre-installed with a plethora of tools, including gowitness. However, if you need to install or update it, follow these steps:#### Step 1: Update Your SystemBefore installing any new tools, ensure that your system is up to date. Open your terminal and run the following commands:
sudo apt update
sudo apt upgrade -y
#### Step 2: Install gowitnessIf gowitness is not installed, you can use the following command:
sudo apt install gowitness
To verify the installation, check the version of gowitness:
#### Step 3: ConfigurationGowitness requires minimal configuration to get started. The main configuration file is typically located in `~/.config/gowitness/config.yaml`. You can customize the settings according to your requirements, such as specifying the output directory for screenshots. The default configuration file can be created by running:
Modify the `config.yaml` file with your preferred settings. Here's an example of what your configuration might look like:[/dm_code_snippet]yaml
output:
directory: "/path/to/screenshot/directory"
format: "png"
[/dm_code_snippet]### 2. Step-by-Step UsageWith gowitness installed and configured, it’s time to explore its functionalities through usage examples.#### Basic UsageGowitness operates primarily through the command line. The basic syntax for capturing a screenshot is:
gowitness single –url https://example.com
This command will take a screenshot of the specified URL and save it to your designated output directory.#### Batch ModeFor pentesters who need to capture multiple screenshots, gowitness offers a batch mode that reads URLs from a file. Here’s how to use it:1. Create a text file named `urls.txt` and list your target URLs, one per line:[/dm_code_snippet]
https://example.com
https://testsite.com
[/dm_code_snippet]2. Run the batch command:
gowitness file –filename urls.txt
This command captures screenshots for all URLs listed in the file.#### Real-World Use Case: ReconnaissanceLet’s look at a real-world example of how to utilize gowitness in a reconnaissance phase of a penetration test.**Scenario:**You are tasked with assessing the security of a company’s web assets. You want to collect screenshots and gather useful metadata from their public-facing web applications.##### Step 1: Gather URLsFirst, collect URLs of the company's web applications. You can use reconnaissance tools like **Amass**, **Sublist3r**, or **Aquatone** to find subdomains and URLs. For example, using Amass:
amass enum -d targetcompany.com -o subdomains.txt
##### Step 2: Capture Screenshots Using gowitnessFirst, you will need to ensure that you have the URLs ready in a file. Assuming your file is ready, run:
gowitness file –filename subdomains.txt
This command will process each URL in the file, capturing screenshots and storing them in your specified output directory.##### Step 3: Review the ResultsAfter the execution, navigate to your output directory and review the screenshots. Each screenshot will be named after the domain or subdomain URL, allowing you to easily correlate them back to your findings.#### Advanced OptionsGowitness offers a variety of additional options to tailor your reconnaissance. Here are a few important flags you can use:– `–timeout
`: Set a global timeout for all requests.
– `–disable-scripts`: Disable JavaScript execution if the page's complexity interferes with screenshots.
– `–user-agent `: Specify a custom user-agent string for your requests.For example, to take screenshots with a timeout of 10 seconds and a custom user-agent:
gowitness single –url https://example.com –timeout 10 –user-agent "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
sudo apt install gowitness
gowitness single –url https://example.com
gowitness file –filename urls.txt
