Visual recon with Aquatone and WebScreenshot
A VPS-based workflow chaining Aquatone subdomain discovery, WebScreenshot capture and express-photo-gallery into a browsable wall of screenshots for triaging a large attack surface.
Screenshotting
Render every live host to an image so a few thousand subdomains can be triaged by eye instead of by hand.