Tools & Techniques: httpx for HTTP Probing

httpx answers 'is this host speaking HTTP and what's the vibe?' faster than opening a browser tab for every subdomain.

It's the glue between Amass and ffuf/nuclei/manual testing.

httpx shines when you treat output as a sortable table, not a trophy scroll. Pair probe results with scope notes so a teammate can reproduce your live-host list without rerunning the entire subdomain chain.

Compare httpx tech tags with Wappalyzer manually once—automation mislabels often enough to matter.

Flags worth knowing

Title, status code, tech detect, follow redirects cautiously, threads with a conscience. Output formats for scripting—JSON lines play nice with jq.

Match redirect behavior to how users hit the app.

Scope-aware usage

Filter input lists to in-scope domains first. Note when httpx hits CDN edges vs origin.

• Save probes with timestamps

• Compare HTTP vs HTTPS separately

• Tag admin panels in notes, not public tweets

Downstream handoff

Live hosts feed manual mapping priority and selective nuclei. Dead hosts still matter for takeover checks sometimes.

Probing isn't permission to attack every 200 OK.

Stay within authorized asset lists and rate guidelines.

Re-probe after major client maintenance windows—load balancers and WAF modes shift more often than recon schedules assume.

Small habits compound—what feels like overhead early becomes speed when deadlines hit.

Sort httpx output by status before manual review—patterns jump out faster.

Redirect chains

Follow redirects mindfully—out-of-scope domains appear in chains more often than you'd expect.

Combine status, title, and tech tags in notes for quick sorting in spreadsheets.

Pipelines at scale

Shard large host lists across machines only when ROE allows distributed scanning.

Store httpx JSON alongside Amass output with shared run IDs—retests diff cleanly.

Probe both 80 and 443 explicitly when clients forget to list both.

---

Worth reading next

Tools & Techniques: Amass for Asset Discovery

Web App Reconnaissance: The Advantage Layer

Recon Series: Subdomain Enumeration