httpx
HTTP toolkit that probes services, captures response metadata, and fingerprints technologies to verify external attack surfaces.
Technical Architecture & Overview
httpx is a multi-purpose HTTP prober that checks URL reachability, response status, headers, and technology fingerprints. It accepts hosts, URLs, and CIDR ranges as input and retries failed requests through the retryablehttp library. Security teams use it to validate external attack surfaces and confirm which web services are active.
Targeted Technical Use Cases
Batch checks of hosts and URLs to confirm live web services, titles, and technology stacks during asset discovery.
Evaluation & Trade-offs
Core Strengths
- +Multi-threaded probing (50 threads by default) with automatic fallback from HTTPS to HTTP.
- +Output fields include status code, page title, detected technologies, and response headers.
- +Integrates with other ProjectDiscovery tools in pipeline workflows.
Trade-Offs & Limitations
- -Probes only the hosts, URLs, and paths given as input and does not crawl application content.
- -WAF and CDN protection can interfere with probes; httpx applies retries and backoffs to handle WAFs.
Defensive Security Application
Verify the scope and response behavior of public-facing web assets before and after remediation.
Frequently Asked Questions
What is httpx?→
httpx is a multi-purpose HTTP prober that checks URL reachability, response status, headers, and technology fingerprints. It accepts hosts, URLs, and CIDR ranges as input and retries failed requests through the retryablehttp library. Security teams use it to validate external attack surfaces and confirm which web services are active.
What is httpx used for?→
Batch checks of hosts and URLs to confirm live web services, titles, and technology stacks during asset discovery.
What are the strengths of httpx?→
- +Multi-threaded probing (50 threads by default) with automatic fallback from HTTPS to HTTP.
- +Output fields include status code, page title, detected technologies, and response headers.
- +Integrates with other ProjectDiscovery tools in pipeline workflows.
What are the limitations of httpx?→
- +Probes only the hosts, URLs, and paths given as input and does not crawl application content.
- +WAF and CDN protection can interfere with probes; httpx applies retries and backoffs to handle WAFs.
How is httpx used defensively?→
Verify the scope and response behavior of public-facing web assets before and after remediation.