httpx: HTTP probing and web fingerprinting for recon

httpx · MIT

httpx takes a list of hosts and tells you which ones actually serve HTTP, and what they are. It is the step that converts a pile of speculative hostnames into a real attack surface — status codes, titles, technologies, TLS details, redirect chains.

Do not confuse it with httpx the Python HTTP client on PyPI. Different project, same name.

Install

go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

If you have the Python httpx installed too, the binaries collide. Rename one or call this one by absolute path.

Core commands

# probe a host list, keep only what responds
httpx -l hosts.txt -silent

# the fingerprinting pass worth running by default
httpx -l hosts.txt -silent -title -tech-detect -status-code -content-length

# full detail as JSON lines
httpx -l hosts.txt -json -o probe.jsonl -tls-grab -favicon -jarm

# non-standard ports
httpx -l hosts.txt -ports 80,443,8080,8443,8000,9000 -silent

-tech-detect uses Wappalyzer fingerprints and is the flag that earns its keep — it is how you find the WordPress install nobody mentioned. -favicon returns an mmh3 hash, which is how you pivot to Shodan and find every other host running the same application.

Output

{"timestamp":"2026-08-29T10:00:00Z","url":"https://api.example.com","status_code":200,
 "title":"Example API","tech":["nginx","OpenResty"],"webserver":"nginx",
 "content_length":1544,"favicon":"-1545961456","host":"93.184.216.34"}

Where it sits in Tandera

httpx is the fingerprint step in recon_web_lite, recon_web_full and recon_api — the only tool scheduled across all three web-facing flows. Everything after it depends on the live-host set it produces.

Tandera also runs it a second time as httpx_screenshot in the enrich phase, capturing page screenshots that become evidence attached to findings. A screenshot is what makes an exposed admin panel legible to a client reading the report months later.

Using it in a pentest

Probe more than 80 and 443. Default behaviour misses the application on 8443 that nobody documented, which is exactly where the interesting things live.

Pay attention to the boring statuses. A wall of 403s across a subdomain range usually means a WAF or a default vhost, not a hardened application — and it tells you the hostname resolves to shared infrastructure. A 401 is more interesting than a 200: something is there and it wants credentials.

Favicon hashes are a pivot, not a finding. Grab them with -favicon, then search the hash on Shodan to find sibling hosts the passive sources missed.

subfinder -d example.com -silent | dnsx -silent | 
  httpx -silent -title -tech-detect -status-code -favicon -json -o live.jsonl