# Httpx

> Use for HTTP service probing, web asset confirmation, technology hints, and endpoint inventory during authorized pentests. Trigger on checking which hosts answer HTTP or HTTPS, identifying admin panels, and building a web testing queue.

- Skill: `timsonner/httpx` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/httpx`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/httpx/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/httpx

---


# Httpx

## Purpose

Use this skill to turn host or domain candidates into a confirmed web attack surface.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Vulnerability Analysis and Retest and Closure

## Use When

- Need to confirm which assets expose HTTP or HTTPS.
- Need titles, status patterns, or technology clues for prioritization.
- Need a clean web target list before manual testing.

## Avoid When

- Targets are non-web only.
- Bulk probing would exceed scope or stability constraints.

## Inputs

- Candidate hosts or domains from inventory, `subfinder`, `amass`, or `nmap`
- Scope exclusions, rate limits, and authentication notes

## Procedure

1. Probe only the approved candidate set.
2. Confirm which assets respond over HTTP or HTTPS.
3. Capture light metadata useful for prioritization.
4. Prioritize admin interfaces, login portals, and unusual response patterns.
5. Hand high-value targets to `gowitness`, `burp-suite`, or `testssl-sh`.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Probe a list of subdomains for live hosts
httpx -l contoso-subs.txt -o contoso-live.txt

# Include status code, title, and content length
httpx -l contoso-subs.txt -status-code -title -content-length -o contoso-live.txt

# Probe non-standard ports
httpx -l contoso-subs.txt -ports 80,443,8080,8443 -o contoso-web.txt

# Follow redirects and include final URL
httpx -l contoso-subs.txt -follow-redirects -o contoso-resolved.txt

# Technology detection
httpx -l contoso-subs.txt -tech-detect -o contoso-tech.txt

# Single target with combined probes
httpx -u https://portal.contoso.com -title -status-code -tech-detect -follow-redirects
```

## Evidence to Capture

- Reachable URLs and schemes
- Login or admin surfaces
- Technology hints that shape the next analysis step

## Safety Boundaries

- Keep probing low impact and rate aware.
- Do not authenticate or change state unless the phase and approval require it.