Scrying — Screenshots & Visual Recon | Tools

Description

Scrying collects RDP, web, and VNC screenshots all in one tool. Built in Rust for performance, it's particularly useful in internal network pentests where you need to quickly triage hundreds of services across different protocols.

Installation

                        BASH
                        
                            # Download from GitHub releases
# https://github.com/nccgroup/scrying/releases

# From source (requires Rust)
git clone https://github.com/nccgroup/scrying.git
cd scrying && cargo build --release

Basic Usage

                        BASH
                        
                            # Screenshot web targets
scrying --target https://target.com --output ./screenshots/

# Screenshot RDP
scrying --target rdp://10.0.0.1 --output ./screenshots/

# From Nmap output
scrying --nmap scan_results.xml --output ./screenshots/

Advanced Usage

                        BASH
                        
                            # Multiple protocols at once
scrying --target-list targets.txt --output ./screenshots/ --threads 20

# Custom timeout
scrying --target https://target.com --timeout 15 --output ./screenshots/

# VNC screenshots
scrying --target vnc://10.0.0.1:5900 --output ./screenshots/

# Process Nessus file
scrying --nessus scan.nessus --output ./screenshots/

Common Workflows

                        BASH
                        
                            # Internal network visual triage
nmap -p 80,443,3389,5900,8080,8443 10.0.0.0/24 -oX scan.xml
scrying --nmap scan.xml --output ./internal_screenshots/ --threads 30

# Review all captured screenshots in one gallery
ls ./internal_screenshots/