R-HTT
httpx
Fast HTTP probing toolkit for confirming which hosts are alive and fingerprinting them at scale.
OVERVIEW
httpx is a ProjectDiscovery tool that takes a list of hosts or URLs and probes each one over HTTP/HTTPS, reporting status code, title, content length, server header, technology stack, and TLS details in a single pass. It's built for throughput, so it's the standard way to turn a list of thousands of subdomains from subfinder or amass into a short, confirmed list of live web targets.
Beyond basic liveness, it can follow redirects, fingerprint the tech stack (via Wappalyzer-style signatures), detect virtual hosts, and pipe results as JSON into other ProjectDiscovery tools like katana or nuclei, making it the connective piece in most recon pipelines.
USE CASES
Practical use cases
- 01
Filtering a large subdomain list down to hosts that actually respond over HTTP/HTTPS.
- 02
Fingerprinting the web server, framework, and technology stack across many hosts at once.
- 03
Feeding a confirmed live-host list into crawlers (katana) or vulnerability scanners (nuclei).
- 04
Spotting virtual hosts and non-standard ports that a simple DNS list would miss.
QUICK START
Right after subdomain/host discovery, to turn a raw list of names into confirmed live web servers with tech, status, and title data.
- Confirm the host list came from an in-scope discovery step (subfinder, amass, client-provided).
- Install httpx via Go install or a precompiled release binary.
- Pipe the host list into httpx with status code, title, and tech-detection flags enabled.
- Export the results as JSON for downstream tools or a quick manual review.
- Spot-check a sample of the confirmed live hosts before scanning further.
cat subdomains.txt | httpx -status-code -title -tech-detect -o live_hosts.txtBEFORE YOU RUN IT
What to check before running it
Even at high concurrency, probing thousands of hosts still generates real traffic against third-party infrastructure — throttle to the agreed rate for shared or client-adjacent assets.
Passive-source host lists (from subfinder/amass) can include stale or decommissioned names; httpx's liveness check is what re-verifies them, don't skip it.
Technology fingerprints are signature-based and can misidentify or miss custom/obfuscated stacks — treat them as a lead, not a confirmed fact.