aeondave/httpx

httpx

Fast HTTP toolkit from ProjectDiscovery — probe and fingerprint web servers at scale.

Quick Start

# Probe a list of hosts
cat hosts.txt | httpx

# Probe with status + title
httpx -l hosts.txt -status-code -title

# Silent (URLs only for live hosts)
cat subs.txt | httpx -silent

Core Flags

| Flag | Description | |------|-------------| | -l <file> | Input file with hosts | | -u <url> | Single target | | -silent | Print live URLs only | | -status-code, -sc | Show HTTP status code | | -title | Extract page title | | -tech-detect, -td | Detect technologies (Wappalyzer) | | -web-server, -server | Show web server header | | -content-type, -ct | Show Content-Type header | | -ip | Resolve and show IP | | -cname | Show CNAME | | -location | Show redirect location | | -content-length, -cl | Show response size | | -hash <algo> | Hash response body (md5,sha1,sha256) | | -favicon | Extract favicon hash (Shodan mmh3) | | -follow-redirects, -fr | Follow HTTP redirects | | -threads <n>, -t <n> | Concurrent threads (default 50) | | -rate-limit <n>, -rl <n> | Requests per second | | -timeout <n> | Timeout in seconds (default 5) | | -retries <n> | Retry count | | -H <header> | Custom header | | -proxy <url> | HTTP/SOCKS5 proxy | | -o <file> | Output file | | -json, -j | JSONL output | | -csv | CSV output | | -ports <p> | Probe specific ports (e.g., 80,443,8080) | | -path <path-or-file> | Probe specific path(s) on each host | | -no-fallback, -nf | Probe both HTTP and HTTPS instead of fallback behavior | | -no-fallback-scheme, -nfs | Do not auto-switch schemes | | -store-response, -sr | Store request/response artifacts | | -store-response-dir, -srd <dir> | Directory for stored artifacts | | -tls-impersonate, -tlsi | Experimental TLS impersonation | | -tls-probe | Probe for TLS | | -http2 | Enable HTTP/2 | | -screenshot | Take screenshots (requires chromium) |

Common Workflows

# Full recon pipeline: subfinder -> httpx
subfinder -d target.com -silent | httpx -status-code -title -tech-detect -o live.txt

# Probe list with all metadata
httpx -l hosts.txt -status-code -title -tech-detect -web-server -ip -o full.json -json

# Agent-safe JSONL baseline with explicit throughput
httpx -l hosts.txt -sc -title -server -td -fr -timeout 10 -retries 1 -rl 50 -t 25 -silent -j -o httpx.jsonl

# Probe known paths and store responses for downstream route/JS parsing
httpx -l hosts.txt -path /,/login,/admin -sc -title -sr -srd recon/httpx_store -silent -j -o httpx_paths.jsonl

# Find admin/login panels
httpx -l hosts.txt -title -silent | grep -iE "admin|login|portal|dashboard"

# Port-specific probing
httpx -l hosts.txt -ports 80,443,8080,8443,3000,8888 -status-code -silent

# Probe both schemes from host-only input
httpx -l hosts.txt -nf -sc -title -silent

# Favicon hash (for Shodan pivot)
httpx -u https://target.com -favicon

# Screenshot all live hosts
httpx -l hosts.txt -screenshot -output screenshots/

Filter Results

# Only 200s
httpx -l hosts.txt -silent -mc 200

# Exclude CDN/redirect noise
httpx -l hosts.txt -silent -fc 301,302 -filter-string "cloudflare"

# Match by response body content
httpx -l hosts.txt -match-string "password" -silent

# Match by response size
httpx -l hosts.txt -ms 1024 -silent

Resources

| File | When to load | |------|--------------| | references/output-fields.md | All output field flags, JSON schema, match/filter options, pipeline patterns |