# httpx: HTTP probing and web fingerprinting for recon

> How to install and run httpx, read its JSON output, and how Tandera uses it to turn a hostname list into a live, fingerprinted attack surface.

`httpx` takes a list of hosts and tells you which ones actually serve HTTP, and what they are. It is the step that converts a pile of speculative hostnames into a real attack surface — status codes, titles, technologies, TLS details, redirect chains.

Do not confuse it with `httpx` the Python HTTP client on PyPI. Different project, same name.

## Install

```bash
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
```

If you have the Python `httpx` installed too, the binaries collide. Rename one or call this one by absolute path.

## Core commands

```bash
# probe a host list, keep only what responds
httpx -l hosts.txt -silent

# the fingerprinting pass worth running by default
httpx -l hosts.txt -silent -title -tech-detect -status-code -content-length

# full detail as JSON lines
httpx -l hosts.txt -json -o probe.jsonl -tls-grab -favicon -jarm

# non-standard ports
httpx -l hosts.txt -ports 80,443,8080,8443,8000,9000 -silent
```

`-tech-detect` uses Wappalyzer fingerprints and is the flag that earns its keep — it is how you find the WordPress install nobody mentioned. `-favicon` returns an mmh3 hash, which is how you pivot to Shodan and find every other host running the same application.

## Output

```json
{"timestamp":"2026-08-29T10:00:00Z","url":"https://api.example.com","status_code":200,
 "title":"Example API","tech":["nginx","OpenResty"],"webserver":"nginx",
 "content_length":1544,"favicon":"-1545961456","host":"93.184.216.34"}
```

## Where it sits in Tandera

httpx is the **fingerprint** step in `recon_web_lite`, `recon_web_full` and `recon_api` — the only tool scheduled across all three web-facing flows. Everything after it depends on the live-host set it produces.

Tandera also runs it a second time as `httpx_screenshot` in the **enrich** phase, capturing page screenshots that become evidence attached to findings. A screenshot is what makes an exposed admin panel legible to a client reading the report months later.

## Using it in a pentest

**Probe more than 80 and 443.** Default behaviour misses the application on 8443 that nobody documented, which is exactly where the interesting things live.

**Pay attention to the boring statuses.** A wall of 403s across a subdomain range usually means a WAF or a default vhost, not a hardened application — and it tells you the hostname resolves to shared infrastructure. A 401 is more interesting than a 200: something is there and it wants credentials.

**Favicon hashes are a pivot, not a finding.** Grab them with `-favicon`, then search the hash on Shodan to find sibling hosts the passive sources missed.

```bash
subfinder -d example.com -silent | dnsx -silent | \
  httpx -silent -title -tech-detect -status-code -favicon -json -o live.jsonl
```

---

Canonical: https://tandera.io/tools/httpx
This page as markdown: https://tandera.io/tools/httpx.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.