Deepak Gupta

HTTP probing

httpx

Multi-purpose HTTP probing toolkit that checks which hosts serve web content and reports status, title, server, TLS and technology data.

ActiveScope a pentest Audit your own exposure

11k stars · last push November 10, 2026 · v1.12.0 · MIT

GitHub repository Official docs

What it finds

httpx takes hosts, URLs or CIDRs and sends HTTP requests to find live web servers, trying HTTPS first and falling back to HTTP. Default probes record status code, title, content length, web server, TLS certificate, IP, CNAME and hashes. Optional flags add Wappalyzer-based tech detection, favicon and JARM hashes, ASN data, path probing and screenshots.

live web servers
HTTP status codes
page titles
web server software
technologies
TLS certificate data
IP addresses
CNAMEs
CDN/WAF in use
favicon hashes
JARM fingerprints

Does it touch the target?

Sends traffic to the target's systems. Use only with the owner's permission.

It sends HTTP requests to every input host: "As default, httpx probe with HTTPS scheme and fall-back to HTTP only if HTTPS is not reachable." Default rate limit is 150 requests per second.

API keys: Probing needs no key; a ProjectDiscovery cloud (pdcp) API key is only for the optional `-dashboard` upload of results.

Install

Install with go

go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

From the project's documentation

Install with package

brew install httpx

From the project's documentation

Install with docker

docker pull projectdiscovery/httpx:latest

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Find live web servers from a host list

cat hosts.txt | httpx

From the project's documentation

Title, technologies and status for discovered subdomains

subfinder -d example.com -silent| httpx -title -tech-detect -status-code

From the project's documentation

Probe a CIDR range for web servers

echo 192.0.2.0/24 | httpx -silent

From the project's documentation

Check for a security.txt file

echo example.com | httpx -path '/.well-known/security.txt,/security.txt' -mc 200 -mdc 'contains(content_type, "text/plain") && contains(body, "Contact:") && contains_any(body, "mailto:", "https://")'

From the project's documentation

Output formats: txt, jsonl, csv

Limits the project documents

"This project is in active development. Expect breaking changes with releases."
"Running it as a service may pose security risks."
README states it "requires go >=1.26.10 to install successfully" via go install.
Screenshots need a headless browser; `-system-chrome` uses a locally installed Chrome.
Page-type classification downloads a model from Hugging Face unless a local model is set with `-ptm`.
Flags such as `-ports`, `-path`, `-vhost`, `-screenshot` and `-favicon` "should be used for specific use cases instead of running them as default".

Deepak's take

Analysis, not documentation

Use it when: Use it right after subdomain or port discovery to sort live web services from dead names and label each with title, status and technology.
Skip it when: For visual triage of hundreds of pages, gowitness gives a browsable screenshot report. For deeper per-site fingerprinting with aggression levels, WhatWeb goes further.
What it will miss: It only tests hosts and ports you feed it, so it will not discover new subdomains or non-HTTP services.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: MIT. httpx is a trademark or project name of its owners; this library is not affiliated with it.