Recon
httpx
HTTP probe to confirm live web services, titles, status codes, and tech from a host list.
What it is
httpx turns a pile of names and IPs into a live HTTP/S inventory: scheme, status, title, tech, and TLS info. Run it after subdomain enum and before crawling or template scans so you do not hammer dead hosts.
Reach for it when
After amass/subfinder/nmap HTTP hits, when you need a clean list of in-scope web and API endpoints.
Watch-outs
Rate and thread counts can look like a layer-7 flood. Honor freeze windows. Do not follow redirects off-scope (CDNs, SSO IdPs, marketing pixels) without checking the RoE.
Typical invocation
httpx -l recon/subs.txt -status-code -title -tech-detect -o recon/httpx.txt
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- subfinder
Passive subdomain discovery from OSINT sources for in-scope apex domains.
- nuclei
Template-based vulnerability scanner for known issues on in-scope web, API, and network services.
- katana
Crawler for JavaScript-heavy web apps and APIs to build an authorized URL inventory.
- Burp Suite
Intercepting proxy and scanner for authorized web and API testing, mapping, and manual review.