# httpx Cheatsheet - Cheatsheets - Launch Pad

__ _______________________ _________._________________________ \_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/ | __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_ | \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \ \___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ / \/ \/ \/ \/ \/ \/ \/

# httpx Cheatsheet

← Back to cheatsheets

← Home

httpx is a fast and multi-purpose HTTP toolkit by ProjectDiscovery. It probes for live hosts, extracts information, and integrates with other tools in recon pipelines.

## Basic Usage

- echo "example.com" | httpx - Probe single host

- cat hosts.txt | httpx - Probe multiple hosts

- httpx -l hosts.txt - Read from file

## Input Options

- -l, -list - Input file with hosts

- -u, -target - Single target URL

- -ports - Ports to probe (comma-separated)

- -path - Path to append to URLs

## Probing Options

- -sc, -status-code - Show status code

- -cl, -content-length - Show content length

- -ct, -content-type - Show content type

- -title - Show page title

- -server - Show server header

- -td, -tech-detect - Detect technologies

- -ip - Show IP address

- -cname - Show CNAME record

- -cdn - Detect CDN

- -location - Show redirect location

- -favicon - Extract favicon hash

- -hash - Show response body hash

- -jarm - Show JARM fingerprint

- -rt, -response-time - Show response time

- -websocket - Detect WebSocket

- -pipeline - Show HTTP pipeline support

- -http2 - Show HTTP/2 support

## Filtering Options

- -mc, -match-code - Match status codes

- -ml, -match-length - Match content length

- -ms, -match-string - Match response string

- -mr, -match-regex - Match regex

- -fc, -filter-code - Filter status codes

- -fl, -filter-length - Filter content length

- -fs, -filter-string - Filter response string

- -fr, -filter-regex - Filter regex

## Output Options

- -o, -output - Output file

- -json - JSON output

- -csv - CSV output

- -silent - Silent mode (only results)

- -v, -verbose - Verbose output

- -nc, -no-color - Disable colors

- -sr, -store-response - Store response

- -srd, -store-response-dir - Response directory

## HTTP Options

- -H, -header - Custom headers

- -x, -http-proxy - HTTP proxy

- -follow-redirects - Follow redirects

- -follow-host-redirects - Follow same-host redirects

- -max-redirects - Maximum redirects

- -timeout - Timeout in seconds

- -retries - Number of retries

- -threads - Concurrent threads

- -rate-limit - Requests per second

## Common Examples

### Basic Probe

    cat subdomains.txt | httpx

Check which subdomains are live.

### With Status and Title

    cat hosts.txt | httpx -sc -title

Show status codes and page titles.

### Tech Detection

    cat hosts.txt | httpx -td

Detect technologies (wappalyzer-like).

### Full Info

    cat hosts.txt | httpx -sc -title -server -td -ip

Comprehensive host information.

### Filter by Status

    cat hosts.txt | httpx -mc 200

Only show 200 OK responses.

### Exclude Status

    cat hosts.txt | httpx -fc 404,403

Exclude 404 and 403 responses.

### JSON Output

    cat hosts.txt | httpx -json -o results.json

Save detailed JSON output.

### Multiple Ports

    cat hosts.txt | httpx -ports 80,443,8080,8443

Check multiple ports.

### Silent for Piping

    subfinder -d example.com -silent | httpx -silent

Clean output for pipelines.

### With Custom Header

    cat hosts.txt | httpx -H "Authorization: Bearer token"

Add auth header to requests.

### Follow Redirects

    cat hosts.txt | httpx -follow-redirects -location

Follow and show redirect locations.

### Store Responses

    cat hosts.txt | httpx -sr -srd ./responses

Save all response bodies.

## Common Pipelines

### Full Subdomain Recon

    subfinder -d example.com -silent | httpx -silent -sc -title -td | tee results.txt

### Find Interesting Pages

    cat urls.txt | httpx -mc 200 -title | grep -i "admin\|login\|dashboard"

### Screenshot Pipeline

    subfinder -d example.com -silent | httpx -silent | aquatone

## Tips

- Use -silent for clean pipeline output

- Combine -sc -title -td for quick triage

- Use -json for detailed data extraction

- Filter with -mc/-fc to focus results

- Store responses for later analysis

- Essential tool in recon pipelines

- Part of ProjectDiscovery toolkit (works with nuclei, subfinder)

- Always get authorization before scanning

← Back to cheatsheets

← Home