httpx

httpx is a multi-purpose HTTP toolkit designed for reconnaissance pipelines — it probes hosts for live status, extracts titles, detects technologies, captures screenshots, and analyzes headers in bulk. curl is a general-purpose HTTP client for single requests and API testing. Use httpx for scanning lists of subdomains; use curl for targeted single-host requests.

A common recon pipeline pipes Subfinder output into httpx: subfinder -d example.com -silent | httpx -silent. Subfinder discovers subdomains passively, then httpx probes each to find which ones are live, extracts status codes, titles, and technologies. This combination is the standard first step in bug bounty reconnaissance.

Yes. Use the -screenshot flag to capture screenshots of live web servers. httpx requires Chromium or Chrome installed on the system for screenshot functionality. Screenshots are useful for visual reconnaissance, identifying login pages, and documenting web applications during penetration testing.

Yes. Use -tech-detect to identify web technologies, frameworks, CMS platforms, and server software running on target hosts. httpx detects technologies from HTTP headers, meta tags, script sources, and cookie patterns. Combine with -json for structured output of detected technologies.

httpx uses a default concurrency of 25 threads for probing hosts. Increase with -c 50 or -c 100 for larger target lists, but monitor for rate limiting and blocking. Start with defaults and increase gradually. Use -rl to set a rate limit (requests per second) to avoid overwhelming targets.

httpx is active — it sends HTTP/HTTPS requests to each target host to determine live status, extract content, and detect technologies. This generates network traffic that can be logged by the target. For passive HTTP reconnaissance, use certificate transparency logs and search engines instead.

HTTPX is a fast, multi-purpose HTTP toolkit developed by ProjectDiscovery. It probes web servers to determine if they are alive, extracts page titles and status codes, identifies technologies and frameworks, captures screenshots, and detects response headers. It is a key tool in reconnaissance pipelines for penetration testing and bug bounty hunting.

HTTPX works by sending HTTP requests to target hosts and analyzing the responses. It checks for HTTP status codes, extracts page titles, identifies technology patterns in response headers and content, and can capture screenshots using headless Chromium. It processes targets concurrently using Go's goroutine model for high-speed bulk probing.

Yes, HTTPX is completely free and open source under the MIT license. It is developed by ProjectDiscovery and available on Kali Linux by default. You can install it from GitHub or use the apt package manager.

HTTPX was developed by ProjectDiscovery, a cybersecurity company that builds open-source security tools. ProjectDiscovery also created Nuclei, Subfinder, and many other popular reconnaissance and security tools used by penetration testers and bug bounty hunters worldwide.

ProjectDiscovery is a cybersecurity company and open-source project that develops reconnaissance and security tools. Their most popular tools include HTTPX, Nuclei, Subfinder, and Chaos. These tools work together as a complete reconnaissance pipeline for penetration testing and bug bounty programs.

On Kali Linux: sudo apt install httpx-toolkit. On other systems: go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest. Verify with httpx -version. You can also download pre-built binaries from the GitHub releases page.

Yes, HTTPX is beginner-friendly. Start with a simple command like httpx -l hosts.txt -title -status-code. Pipe output from Subfinder directly into HTTPX. The tool has a gentle learning curve and produces immediately useful results.

Yes, HTTPX is essential for bug bounty reconnaissance. It identifies live hosts from subdomain lists, detects technologies to focus testing efforts, and integrates seamlessly with Nuclei for automated vulnerability scanning. Most bug bounty hunters use HTTPX as a core step in their recon pipeline.

HTTPX is written in Go (Golang). This gives it excellent performance through concurrent goroutine processing, cross-platform compatibility, and easy installation via go install. The Go language enables HTTPX to process thousands of hosts simultaneously.

HTTPX focuses on HTTP/HTTPS probing — detecting live web servers, extracting titles, identifying technologies, and capturing screenshots. Nmap is a comprehensive network scanner for port discovery, service detection, and OS fingerprinting. HTTPX excels at web reconnaissance; Nmap excels at network mapping.

HTTPX is faster and better for bulk HTTP probing and live host detection with basic technology identification. WhatWeb provides deeper technology fingerprinting through plugin-based analysis. Use HTTPX first for speed, then WhatWeb for detailed technology analysis on interesting targets.

Yes, detecting live hosts is HTTPX's primary function. It sends HTTP requests to each target and reports which ones return valid HTTP responses. Use -status-code to see response codes and -title to extract page names from live hosts.

Yes, HTTPX can capture screenshots using the -screenshot flag. This requires Chromium or Chrome headless browser to be installed. Screenshots are saved to the output directory and are useful for visual reconnaissance and reporting.

Pipe Subfinder output directly to HTTPX: subfinder -d target.com | httpx -title -status-code -tech-detect. This discovers subdomains and immediately probes them for live hosts, page titles, and technologies in a single pipeline.

HTTPX supports JSON (-json), CSV (-csv), and plain text output. JSON is best for programmatic processing and tool integration. CSV is useful for spreadsheet analysis. Plain text is easiest for manual review. Use -o to save output to a file.

Yes, the -tech-detect flag identifies frameworks, CMS, servers, and libraries through response header analysis and pattern matching. It detects WordPress, Laravel, React, Angular, Nginx, Apache, and many more technologies.

Use -c or -threads to set concurrent requests (default: 25). Higher values increase speed but may trigger rate limiting. Use -delay to add delays between requests. Start with -c 10 for sensitive targets and increase as needed.

Yes, use -follow-redirects to track redirect chains and report the final destination URL. This is useful for identifying URL shorteners, domain redirects, and HTTP-to-HTTPS redirects that mask the actual target.

Use -fc to filter out specific status codes (e.g., -fc 404,403). Use -mc to match only specific codes (e.g., -mc 200,301). Use -cl to filter by content length. Use -title to filter by page title text.

Yes, use -proxy to route all HTTPX traffic through a proxy server: httpx -proxy http://127.0.0.1:8080 -l urls.txt. This is useful for testing through corporate proxies, anonymizing scan origin, or routing through Burp Suite for manual analysis.

On Kali, run 'sudo apt update && sudo apt install httpx-toolkit'. Kali packages it as httpx-toolkit to avoid a name clash with an unrelated Python 'httpx' library, so the binary may be invoked as httpx-toolkit or httpx depending on your PATH. For the newest release use Go: 'go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest'. See the full Kali tools list for related recon utilities.

There are two unrelated tools named httpx: the ProjectDiscovery HTTP toolkit (Go) and a Python HTTP client library. If 'httpx' opens a Python tool, you installed the wrong one. On Kali use the httpx-toolkit package, or install the Go binary and make sure its path (~/go/bin) comes first in your PATH.

By default httpx probes common schemes automatically. To be explicit, use -ports to add ports (e.g., -ports 80,443,8080,8443) and httpx will test each host across them. Pipe a plain hostname list in and httpx resolves the working scheme and port for each live server.

curl makes one carefully controlled request at a time and is ideal for API testing and debugging a single endpoint. httpx is built for scale: it probes thousands of hosts concurrently, extracts titles, status codes, and technologies, and outputs structured JSON. Use curl to inspect one target, httpx to triage many. For port-level checks, pair either with Nmap.

Feed live URLs from httpx straight into Nuclei: 'subfinder -d target.com | httpx -silent | nuclei -t cves/'. httpx filters the list down to live web servers so Nuclei only scans real targets, which saves time and reduces noise against the target.

Increase concurrency with -c (or -threads), raise -rate-limit carefully, and use -silent to cut console overhead. For very large lists, disable expensive features you do not need, such as -screenshot and -tech-detect, and add them back in a second pass against only the live hosts.

That warning means a host did not respond within the timeout. Raise it with -timeout 10, lower concurrency with -c so you are not overwhelming your own connection, and confirm the target is reachable using basic Linux commands like ping and curl. Slow or filtered hosts will always produce some timeouts.

Yes. Combine flags: 'httpx -l hosts.txt -title -status-code -tech-detect'. This prints each live URL alongside its HTTP status, page title, and detected technologies in one pass, which is the most common triage command for narrowing a large host list to interesting targets.

Use -o for plain text ('-o live.txt') or -json for structured output ('-json -o live.json'). JSON records the status code, title, technologies, and content length per host, which makes it easy to feed results into scripts, dashboards, or the next tool in your pipeline.

httpx is active: it sends real requests to the target, so only run it against systems you own or are authorised to test. Keep concurrency and rate limits reasonable to avoid disrupting the service, follow the bug bounty program's rules of engagement, and practise first in the Terminal Sandbox.

Match only the codes you care about with -mc (e.g., -mc 200,301) or filter out noise with -fc (e.g., -fc 404,403). You can also filter by content length with -fl and by response body with -fs, which is handy for stripping out identical error or parking pages.

Yes. httpx is a single cross-platform Go binary, so it runs on Windows, macOS, and Linux. Download the release for your OS from the ProjectDiscovery GitHub, or install with 'go install' if you have Go. The screenshot feature additionally needs Chromium or Chrome installed on that platform.