httpx — Network Analysis and Diagnostics

Latest Tool Guides / Network Analysis and Diagnostics / httpx.html

A Go-based probing toolkit that quickly batch-checks HTTP status, TLS, headers, and titles of bulk URLs.

Basic Information

What is this program?

httpx is a tool that sends HTTP requests to large lists of URLs and quickly collects response status codes, titles, server headers, TLS certificate information, etc. It processes thousands to tens of thousands of URLs in parallel to check their availability and details.

As a core component of the ProjectDiscovery security tool ecosystem, it can be piped together with subfinder and naabu to automate recon workflows. It supports JSON output by default, making it easy to integrate with subsequent tools.

What problem does it solve?

• Batch-checks whether all deployed hundreds of URLs respond normally (200).
• Checks for impending TLS certificate expiration and hostname mismatches.
• Quickly collects web server software version (HTTP Server header).
• Filters the validity of the target URL list before security scans.

Key Features

Bulk URL Parallel Probing

Sends parallel requests to thousands of URLs to collect status codes, titles, and headers.

• Usage Scenarios: Used for batch availability checks after CDN and multi-domain deployments.
• Results Obtained: Checking tens of thousands of URLs is completed within minutes.
• Limitations: Excessive parallel requests may overload the target server.

TLS & Certificate Information Collection

Checks TLS certificate issuer, expiration date, and hostname match status.

• Usage Scenarios: Used to prevent service disruptions due to certificate expiration.
• Results Obtained: Allows early discovery of certificates nearing expiration.
• Limitations: Services that do not support TLS require separate handling.

Technology Stack Detection

Detects web frameworks, CDNs, and WAFs based on HTTP headers, cookies, and path patterns.

• Usage Scenarios: Used to identify the target's technology stack and gather vulnerability information.
• Results Obtained: Automatically identifies technology configurations like Nginx, Cloudflare, WordPress, etc.
• Limitations: Sophisticated WAFs may be excluded from detection.

JSON & Piped Output

Exports all results in JSON and can be piped to other tools.

• Usage Scenarios: Used to connect with subfinder and naabu to build an automated recon pipeline.
• Results Obtained: The entire security investigation workflow is completed without manual work.
• Limitations: Piped configuration can be complex for beginners.

Installation and Execution

Binary Download

Download the binary for the corresponding platform from GitHub releases.

# Linux amd64 example
wget https://github.com/projectdiscovery/httpx/releases/latest/download/httpx_linux_amd64.zip
unzip httpx_linux_amd64.zip
sudo mv httpx /usr/local/bin/

# Verify installation
httpx -version

go install

Install from the Go environment.

go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

Docker

Run in isolation with Docker.

docker pull projectdiscovery/httpx:latest
echo "example.com" | docker run -i projectdiscovery/httpx -silent

Practical Usage Examples

Single URL Status Check

Check a URL's response status, title, and technology stack.

# Single URL check
echo "https://example.com" | httpx -silent -status-code -title -tech-detect

Bulk URL Batch Check

Check all URLs from a file at once.

# Check all URLs in urls.txt
httpx -l urls.txt -silent -status-code -content-length -follow-redirects

# Result: Status code, size, and redirect path for each URL

Piping with naabu

Extract and check only HTTP services from port scan results.

# naabu port scan → httpx probing
naabu -host example.com -p 80,443,8080 -silent | httpx -silent -status-code -title

# Shows only those that respond with HTTP among the open ports