We already talked about using DNS records to find web applications tied to specific organizations, but there are tools that will search ports that web applications are commonly hosted on, take a screenshot of the web application, and put it into a report for you.
Moreover, some tools will take Nessus or Nmap output and visit and screenshot all web applications that Nessus or Nmap identified.
