httpx
Fast HTTP toolkit from ProjectDiscovery — probe and fingerprint web servers at scale.
Quick Start
# Probe a list of hosts
cat hosts.txt | httpx
# Probe with status + title
httpx -l hosts.txt -status-code -title
# Silent (URLs only for live hosts)
cat subs.txt | httpx -silent
Core Flags
| Flag |
Description |
-l <file> |
Input file with hosts |
-u <url> |
Single target |
-silent |
Print live URLs only |
-status-code, -sc |
Show HTTP status code |
-title |
Extract page title |
-tech-detect, -td |
Detect technologies (Wappalyzer) |
-web-server, -server |
Show web server header |
-content-type, -ct |
Show Content-Type header |
-ip |
Resolve and show IP |
-cname |
Show CNAME |
-location |
Show redirect location |
-content-length, -cl |
Show response size |
-hash <algo> |
Hash response body (md5,sha1,sha256) |
-favicon |
Extract favicon hash (Shodan mmh3) |
-follow-redirects, -fr |
Follow HTTP redirects |
-threads <n>, -t <n> |
Concurrent threads (default 50) |
-rate-limit <n>, -rl <n> |
Requests per second |
-timeout <n> |
Timeout in seconds (default 5) |
-retries <n> |
Retry count |
-H <header> |
Custom header |
-proxy <url> |
HTTP/SOCKS5 proxy |
-o <file> |
Output file |
-json, -j |
JSONL output |
-csv |
CSV output |
-ports <p> |
Probe specific ports (e.g., 80,443,8080) |
-path <path-or-file> |
Probe specific path(s) on each host |
-no-fallback, -nf |
Probe both HTTP and HTTPS instead of fallback behavior |
-no-fallback-scheme, -nfs |
Do not auto-switch schemes |
-store-response, -sr |
Store request/response artifacts |
-store-response-dir, -srd <dir> |
Directory for stored artifacts |
-tls-impersonate, -tlsi |
Experimental TLS impersonation |
-tls-probe |
Probe for TLS |
-http2 |
Enable HTTP/2 |
-screenshot |
Take screenshots (requires chromium) |
Common Workflows
# Full recon pipeline: subfinder -> httpx
subfinder -d target.com -silent | httpx -status-code -title -tech-detect -o live.txt
# Probe list with all metadata
httpx -l hosts.txt -status-code -title -tech-detect -web-server -ip -o full.json -json
# Agent-safe JSONL baseline with explicit throughput
httpx -l hosts.txt -sc -title -server -td -fr -timeout 10 -retries 1 -rl 50 -t 25 -silent -j -o httpx.jsonl
# Probe known paths and store responses for downstream route/JS parsing
httpx -l hosts.txt -path /,/login,/admin -sc -title -sr -srd recon/httpx_store -silent -j -o httpx_paths.jsonl
# Find admin/login panels
httpx -l hosts.txt -title -silent | grep -iE "admin|login|portal|dashboard"
# Port-specific probing
httpx -l hosts.txt -ports 80,443,8080,8443,3000,8888 -status-code -silent
# Probe both schemes from host-only input
httpx -l hosts.txt -nf -sc -title -silent
# Favicon hash (for Shodan pivot)
httpx -u https://target.com -favicon
# Screenshot all live hosts
httpx -l hosts.txt -screenshot -output screenshots/
Filter Results
# Only 200s
httpx -l hosts.txt -silent -mc 200
# Exclude CDN/redirect noise
httpx -l hosts.txt -silent -fc 301,302 -filter-string "cloudflare"
# Match by response body content
httpx -l hosts.txt -match-string "password" -silent
# Match by response size
httpx -l hosts.txt -ms 1024 -silent
Resources
| File |
When to load |
references/output-fields.md |
All output field flags, JSON schema, match/filter options, pipeline patterns |
1---2name: httpx3description: Auth/lab ref: Fast HTTP probing tool for bulk URL processing, status codes, title extraction, tech detection, and web fingerprinting.4license: MIT5---67# httpx89Fast HTTP toolkit from ProjectDiscovery — probe and fingerprint web servers at scale.1011## Quick Start1213```bash14# Probe a list of hosts15cat hosts.txt | httpx1617# Probe with status + title18httpx -l hosts.txt -status-code -title1920# Silent (URLs only for live hosts)21cat subs.txt | httpx -silent22```2324## Core Flags2526| Flag | Description |27|------|-------------|28| `-l <file>` | Input file with hosts |29| `-u <url>` | Single target |30| `-silent` | Print live URLs only |31| `-status-code`, `-sc` | Show HTTP status code |32| `-title` | Extract page title |33| `-tech-detect`, `-td` | Detect technologies (Wappalyzer) |34| `-web-server`, `-server` | Show web server header |35| `-content-type`, `-ct` | Show Content-Type header |36| `-ip` | Resolve and show IP |37| `-cname` | Show CNAME |38| `-location` | Show redirect location |39| `-content-length`, `-cl` | Show response size |40| `-hash <algo>` | Hash response body (md5,sha1,sha256) |41| `-favicon` | Extract favicon hash (Shodan mmh3) |42| `-follow-redirects`, `-fr` | Follow HTTP redirects |43| `-threads <n>`, `-t <n>` | Concurrent threads (default 50) |44| `-rate-limit <n>`, `-rl <n>` | Requests per second |45| `-timeout <n>` | Timeout in seconds (default 5) |46| `-retries <n>` | Retry count |47| `-H <header>` | Custom header |48| `-proxy <url>` | HTTP/SOCKS5 proxy |49| `-o <file>` | Output file |50| `-json`, `-j` | JSONL output |51| `-csv` | CSV output |52| `-ports <p>` | Probe specific ports (e.g., `80,443,8080`) |53| `-path <path-or-file>` | Probe specific path(s) on each host |54| `-no-fallback`, `-nf` | Probe both HTTP and HTTPS instead of fallback behavior |55| `-no-fallback-scheme`, `-nfs` | Do not auto-switch schemes |56| `-store-response`, `-sr` | Store request/response artifacts |57| `-store-response-dir`, `-srd <dir>` | Directory for stored artifacts |58| `-tls-impersonate`, `-tlsi` | Experimental TLS impersonation |59| `-tls-probe` | Probe for TLS |60| `-http2` | Enable HTTP/2 |61| `-screenshot` | Take screenshots (requires chromium) |6263## Common Workflows6465```bash66# Full recon pipeline: subfinder -> httpx67subfinder -d target.com -silent | httpx -status-code -title -tech-detect -o live.txt6869# Probe list with all metadata70httpx -l hosts.txt -status-code -title -tech-detect -web-server -ip -o full.json -json7172# Agent-safe JSONL baseline with explicit throughput73httpx -l hosts.txt -sc -title -server -td -fr -timeout 10 -retries 1 -rl 50 -t 25 -silent -j -o httpx.jsonl7475# Probe known paths and store responses for downstream route/JS parsing76httpx -l hosts.txt -path /,/login,/admin -sc -title -sr -srd recon/httpx_store -silent -j -o httpx_paths.jsonl7778# Find admin/login panels79httpx -l hosts.txt -title -silent | grep -iE "admin|login|portal|dashboard"8081# Port-specific probing82httpx -l hosts.txt -ports 80,443,8080,8443,3000,8888 -status-code -silent8384# Probe both schemes from host-only input85httpx -l hosts.txt -nf -sc -title -silent8687# Favicon hash (for Shodan pivot)88httpx -u https://target.com -favicon8990# Screenshot all live hosts91httpx -l hosts.txt -screenshot -output screenshots/92```9394## Filter Results9596```bash97# Only 200s98httpx -l hosts.txt -silent -mc 20099100# Exclude CDN/redirect noise101httpx -l hosts.txt -silent -fc 301,302 -filter-string "cloudflare"102103# Match by response body content104httpx -l hosts.txt -match-string "password" -silent105106# Match by response size107httpx -l hosts.txt -ms 1024 -silent108```109110## Resources111112| File | When to load |113|------|--------------|114| `references/output-fields.md` | All output field flags, JSON schema, match/filter options, pipeline patterns |
AeonDave