__ _______________________ _________._________________________ \_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/ | __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_ | \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \ \___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ / \/ \/ \/ \/ \/ \/ \/

httpx Cheatsheet

← Back to cheatsheets

← Home

httpx is a fast and multi-purpose HTTP toolkit by ProjectDiscovery. It probes for live hosts, extracts information, and integrates with other tools in recon pipelines.

Basic Usage

  • echo "example.com" | httpx - Probe single host
  • cat hosts.txt | httpx - Probe multiple hosts
  • httpx -l hosts.txt - Read from file

Input Options

  • -l, -list - Input file with hosts
  • -u, -target - Single target URL
  • -ports - Ports to probe (comma-separated)
  • -path - Path to append to URLs

Probing Options

  • -sc, -status-code - Show status code
  • -cl, -content-length - Show content length
  • -ct, -content-type - Show content type
  • -title - Show page title
  • -server - Show server header
  • -td, -tech-detect - Detect technologies
  • -ip - Show IP address
  • -cname - Show CNAME record
  • -cdn - Detect CDN
  • -location - Show redirect location
  • -favicon - Extract favicon hash
  • -hash - Show response body hash
  • -jarm - Show JARM fingerprint
  • -rt, -response-time - Show response time
  • -websocket - Detect WebSocket
  • -pipeline - Show HTTP pipeline support
  • -http2 - Show HTTP/2 support

Filtering Options

  • -mc, -match-code - Match status codes
  • -ml, -match-length - Match content length
  • -ms, -match-string - Match response string
  • -mr, -match-regex - Match regex
  • -fc, -filter-code - Filter status codes
  • -fl, -filter-length - Filter content length
  • -fs, -filter-string - Filter response string
  • -fr, -filter-regex - Filter regex

Output Options

  • -o, -output - Output file
  • -json - JSON output
  • -csv - CSV output
  • -silent - Silent mode (only results)
  • -v, -verbose - Verbose output
  • -nc, -no-color - Disable colors
  • -sr, -store-response - Store response
  • -srd, -store-response-dir - Response directory

HTTP Options

  • -H, -header - Custom headers
  • -x, -http-proxy - HTTP proxy
  • -follow-redirects - Follow redirects
  • -follow-host-redirects - Follow same-host redirects
  • -max-redirects - Maximum redirects
  • -timeout - Timeout in seconds
  • -retries - Number of retries
  • -threads - Concurrent threads
  • -rate-limit - Requests per second

Common Examples

Basic Probe

cat subdomains.txt | httpx

Check which subdomains are live.

With Status and Title

cat hosts.txt | httpx -sc -title

Show status codes and page titles.

Tech Detection

cat hosts.txt | httpx -td

Detect technologies (wappalyzer-like).

Full Info

cat hosts.txt | httpx -sc -title -server -td -ip

Comprehensive host information.

Filter by Status

cat hosts.txt | httpx -mc 200

Only show 200 OK responses.

Exclude Status

cat hosts.txt | httpx -fc 404,403

Exclude 404 and 403 responses.

JSON Output

cat hosts.txt | httpx -json -o results.json

Save detailed JSON output.

Multiple Ports

cat hosts.txt | httpx -ports 80,443,8080,8443

Check multiple ports.

Silent for Piping

subfinder -d example.com -silent | httpx -silent

Clean output for pipelines.

With Custom Header

cat hosts.txt | httpx -H "Authorization: Bearer token"

Add auth header to requests.

Follow Redirects

cat hosts.txt | httpx -follow-redirects -location

Follow and show redirect locations.

Store Responses

cat hosts.txt | httpx -sr -srd ./responses

Save all response bodies.

Common Pipelines

Full Subdomain Recon

subfinder -d example.com -silent | httpx -silent -sc -title -td | tee results.txt

Find Interesting Pages

cat urls.txt | httpx -mc 200 -title | grep -i "admin\|login\|dashboard"

Screenshot Pipeline

subfinder -d example.com -silent | httpx -silent | aquatone

Tips

  • Use -silent for clean pipeline output
  • Combine -sc -title -td for quick triage
  • Use -json for detailed data extraction
  • Filter with -mc/-fc to focus results
  • Store responses for later analysis
  • Essential tool in recon pipelines
  • Part of ProjectDiscovery toolkit (works with nuclei, subfinder)
  • Always get authorization before scanning

← Back to cheatsheets

← Home