httpx
Fast HTTP toolkit that probes services, captures response metadata, and fingerprints technologies to verify external attack surfaces.
Technical Architecture & Overview
httpx is a multi-purpose HTTP prober that checks URL reachability, response status, headers, and technology fingerprints. It handles large input lists and supports retryable HTTP connections for reliable results. Security teams use it to validate external attack surfaces and confirm which web services are active.
Targeted Technical Use Cases
Batch checks of hosts and URLs to confirm live web services, titles, and technology stacks during asset discovery.
Evaluation & Trade-offs
Core Strengths
- +Fast multi-threaded probes with HTTP and HTTPS fallback.
- +Rich output with status, title, tech stack, and response headers.
- +Integrates with other ProjectDiscovery tools in pipeline workflows.
Trade-Offs & Limitations
- -Limited to HTTP-based checks and does not crawl application content.
- -Can be rate-limited by WAFs or CDN protection.
- -No built-in crawling beyond single requests.
Defensive Security Application
Verify the scope and response behavior of public-facing web assets before and after remediation.
Frequently Asked Questions
What is httpx?→
httpx is a multi-purpose HTTP prober that checks URL reachability, response status, headers, and technology fingerprints. It handles large input lists and supports retryable HTTP connections for reliable results. Security teams use it to validate external attack surfaces and confirm which web services are active.
What is httpx used for?→
Batch checks of hosts and URLs to confirm live web services, titles, and technology stacks during asset discovery.
What are the strengths of httpx?→
- +Fast multi-threaded probes with HTTP and HTTPS fallback.
- +Rich output with status, title, tech stack, and response headers.
- +Integrates with other ProjectDiscovery tools in pipeline workflows.
What are the limitations of httpx?→
- +Limited to HTTP-based checks and does not crawl application content.
- +Can be rate-limited by WAFs or CDN protection.
- +No built-in crawling beyond single requests.
How is httpx used defensively?→
Verify the scope and response behavior of public-facing web assets before and after remediation.