Httpx

Httpx

Purpose

Use this skill to turn host or domain candidates into a confirmed web attack surface.

Phase Fit

• Primary: Discovery and Reconnaissance
• Secondary: Vulnerability Analysis and Retest and Closure

Use When

• Need to confirm which assets expose HTTP or HTTPS.
• Need titles, status patterns, or technology clues for prioritization.
• Need a clean web target list before manual testing.

Avoid When

• Targets are non-web only.
• Bulk probing would exceed scope or stability constraints.

Inputs

• Candidate hosts or domains from inventory, subfinder, amass, or nmap
• Scope exclusions, rate limits, and authentication notes

Procedure

1. Probe only the approved candidate set.
2. Confirm which assets respond over HTTP or HTTPS.
3. Capture light metadata useful for prioritization.
4. Prioritize admin interfaces, login portals, and unusual response patterns.
5. Hand high-value targets to gowitness, burp-suite, or testssl-sh.

Command Syntax

Replace sample targets with approved in-scope assets.

# Probe a list of subdomains for live hosts
httpx -l contoso-subs.txt -o contoso-live.txt

# Include status code, title, and content length
httpx -l contoso-subs.txt -status-code -title -content-length -o contoso-live.txt

# Probe non-standard ports
httpx -l contoso-subs.txt -ports 80,443,8080,8443 -o contoso-web.txt

# Follow redirects and include final URL
httpx -l contoso-subs.txt -follow-redirects -o contoso-resolved.txt

# Technology detection
httpx -l contoso-subs.txt -tech-detect -o contoso-tech.txt

# Single target with combined probes
httpx -u https://portal.contoso.com -title -status-code -tech-detect -follow-redirects

Evidence to Capture

• Reachable URLs and schemes
• Login or admin surfaces
• Technology hints that shape the next analysis step

Safety Boundaries

• Keep probing low impact and rate aware.
• Do not authenticate or change state unless the phase and approval require it.