httpx-toolkit

No entries match these filters. Clear filters

1. v1.11.0 Aug 31, 2026 · issue 060

   httpx v1.11.0 adds -kb knowledge-base classification flag and chrome/JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. strategies for TLS impersonation

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.11.0 https://github.com/projectdiscovery/httpx.git
   # already have the repo? check out this version:
   $ git checkout v1.11.0

   └──▷ TRY IT
   Enable knowledge-base page classification to tag pages as login, captcha, parked, etc., then filter on the result.
   copy

   $ httpx -l targets.txt -kb -fpt parked,captcha -o live.txt

   • Adds -kb / -knowledge-base flag to make page-type classification opt-in rather than always-on.
   • Adds chrome and JA3 strategies to the existing -tls-impersonate flag for more realistic TLS fingerprint spoofing.

   2 details in Everything

2. v1.10.0 Jul 9, 2026 · issue 011

   httpx v1.10.0 adds duplicate custom request headers, IP-aware deduplication, and automatic HTTP_PROXY env var support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.10.0 https://github.com/projectdiscovery/httpx.git
   # already have the repo? check out this version:
   $ git checkout v1.10.0

   └──▷ TRY IT
   Inject multiple instances of the same header (e.g., to test WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. bypass or header-smuggling behavior) in a single httpx probe.
   copy

   $ httpx -u https://target.example.com -H 'X-Forwarded-For: 127.0.0.1' -H 'X-Forwarded-For: 10.0.0.1' -sc -title

   Route all httpx traffic through a proxy without adding the -proxy flag — useful in CI pipelines where the proxy is already set in the environment.
   copy

   $ HTTP_PROXY=http://proxy.corp.example.com:8080 httpx -l targets.txt -sc -title -td

   • Supports sending duplicate custom request headers in a single request (e.g., multiple X-Forwarded-For values).
   • Adds IP-aware deduplication to filter results that resolve to the same IP across different hostnames.
   • Automatically honors HTTP_PROXY/HTTPS_PROXY environment variables when -proxy flag is not explicitly set.

   3 details in Everything

3. v1.9.0 Mar 9, 2026 · release notes

   httpx v1.9.0 adds page-type classification filtering, database output (MongoDB/PostgreSQL/MySQL), and Markdown reporting.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.0 https://github.com/projectdiscovery/httpx.git
   # already have the repo? check out this version:
   $ git checkout v1.9.0

   └──▷ TRY IT
   Skip parked domains and CAPTCHA pages during recon to reduce noise in large-scale scans.
   copy

   $ cat targets.txt | httpx -fpt parked,captcha -o live_hosts.txt

   Surface only login pages across a target list — useful for credential-stuffing or password-spray assessments.
   copy

   $ cat targets.txt | httpx -fpt login -silent

   • New -fpt/-filter-page-type flag classifies and filters responses by page type (e.g. login, captcha, parked) using a page, form, and form-field classifier.
   • Adds database output support — scan results can now be stored directly to MongoDB, PostgreSQL, or MySQL.
   • Adds Markdown output format for scan results.

   3 details in Everything

4. v1.8.0 Jan 21, 2026 · release notes

   httpx v1.8.0 adds Burp XML input, secret-file auth, and passive CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently./WordPress detection

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.8.0 https://github.com/projectdiscovery/httpx.git
   # already have the repo? check out this version:
   $ git checkout v1.8.0

   └──▷ TRY IT
   Authenticate against targets using credentials stored in a secrets file to avoid leaking them in shell history or process listings.
   copy

   $ httpx -l targets.txt -sf secrets.txt -o results.txt

   • Adds Burp XML input mode (-im flag) so you can feed Burp Suite XML exports directly into httpx.
   • Adds secret file authentication support (-sf flag) for supplying credentials from a file without exposing them on the command line.
   • Adds passive CPE and WordPress detection, expanding fingerprinting coverage without extra active probes.

   3 details in Everything

5. v1.7.3 Dec 6, 2025 · release notes

   httpx v1.7.3 adds a new host_ip JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. field exposing the dialed/used IP address.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.7.3 https://github.com/projectdiscovery/httpx.git
   # already have the repo? check out this version:
   $ git checkout v1.7.3

   └──▷ TRY IT
   Extract both the hostname and the actual dialed IP from scan results — useful when targets resolve to CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. or load-balanced IPs you want to track.
   copy

   $ httpx -l targets.txt -json | jq '{host: .host, ip: .host_ip}'

   └──▷ BREAKING ON UPGRADE

   • !The host JSON field now returns the hostname instead of the IP address — pipelines that relied on host for the resolved IP must switch to the new host_ip field.
6. v1.7.2 Nov 14, 2025 · release notes

   httpx v1.7.2 adds JS injection, dynamic filtering, custom fingerprints, network logging, and auto-referer support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.7.2 https://github.com/projectdiscovery/httpx.git
   # already have the repo? check out this version:
   $ git checkout v1.7.2

   └──▷ TRY IT
   Automatically set the Referer header to each target URL to bypass basic referer-based access controls during recon.
   copy

   $ cat targets.txt | httpx --auto-referer -silent -status-code

   • Adds JS injection support for probing JavaScript-rendered targets.
   • Introduces dynamic filtering to filter responses on-the-fly based on observed output.
   • Adds custom fingerprint support for user-defined technology detection rules.
   • Adds network logging to capture low-level network activity during probing.
   • Adds --auto-referer option to automatically set the Referer header to the target URL.

   +2 more show less

   • Adds shorthand flag for the websocket probe option on the command line.
   • Strips ANSI color codes from output files while preserving colors in console output.

   7 details in Everything

7. v1.7.0 Apr 24, 2025 · release notes

   httpx v1.7.0 adds -no-screenshot-full-page flag to disable full-page screenshot capture.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.7.0 https://github.com/projectdiscovery/httpx.git
   # already have the repo? check out this version:
   $ git checkout v1.7.0

   └──▷ TRY IT
   When screenshotting a large list of targets where full-page rendering is slow or unnecessary, restrict captures to the visible viewport to speed up the run.
   copy

   $ httpx -l targets.txt -screenshot -no-screenshot-full-page -o results.json

8. v1.6.10 Jan 27, 2025 · release notes

   httpx v1.6.10 adds lazy-loaded screenshots in HTML summary reports and a CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. bottleneck fix via fastdialer v0.3.0.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.6.10 https://github.com/projectdiscovery/httpx.git
   # already have the repo? check out this version:
   $ git checkout v1.6.10

   • Adds lazy loading to screenshot images in HTML summary reports, improving browser performance when reviewing large scan results.
   • Updates fastdialer to v0.3.0, resolving a CPU bottleneck in the dialer dependency that can improve throughput at scale.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The unused proxy flag has been removed.
9. v1.6.9 Oct 20, 2024 · release notes

   httpx v1.6.9 adds near-duplicate filtering, connection tracing, page-type classification, and smarter screenshot timing

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.6.9 https://github.com/projectdiscovery/httpx.git
   # already have the repo? check out this version:
   $ git checkout v1.6.9

   └──▷ TRY IT
   Trace the full connection to a target (TLS handshake, redirects, timings) and emit structured JSON for ingestion into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.
   copy

   $ httpx -u example.com -trace -j

   • Adds -fd/-filter-duplicates flag to deduplicate near-identical HTTP responses, retaining only the first unique response
   • Adds -trace flag to log the complete HTTP connection lifecycle for a target
   • Adds -sid/-screenshot-idle flag to configure idle wait time before capturing a screenshot when using -screenshot
   • Adds -tid/-team-id flag to upload scan results to a specific team in the ProjectDiscovery Cloud Platform dashboard
   • Adds initial automatic page-type classifier to categorize crawled pages

   +1 more show less

   • Supports providing PDCP authentication credentials via config file

   6 details in Everything

10. v1.6.8 Aug 14, 2024 · release notes

    httpx v1.6.8 adds SDK controls for stdout suppression, server lifecycle management, and chained stdout piping.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.8 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.6.8

    • Adds option to disable stdout output when using httpx as an SDK library.
    • Adds *Server.Stop method to the SDK for explicit server lifecycle control.
    • Exposes ChainInStdout option for library consumers to chain httpx output into their own stdout pipelines.

    3 details in Everything

11. v1.6.7 Aug 2, 2024 · release notes

    httpx v1.6.7 adds a ProjectDiscovery Cloud UI dashboard and ML-based error page filtering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.7 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.6.7

    └──▷ TRY IT
    Push a previously collected httpx JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. result file to PDCP without re-scanning.
    copy

    $ httpx -pdu results.jsonl

    Strip generic error pages (404 templates, Cloudflare blocks, etc.) from results using ML detection to reduce noise.
    copy

    $ cat hosts.txt | httpx -fep -o clean-results.jsonl

    • Adds -pd/-dashboard flag to upload and view httpx scan output in the ProjectDiscovery Cloud (PDCP) UI dashboard.
    • Adds -aid/-asset-id and -aname/-asset-name flags to organize uploads into existing asset groups in PDCP.
    • Adds -pdu/-dashboard-upload flag to push a previously saved httpx JSONL output file directly to the PDCP dashboard.
    • Adds -fep/-filter-error-page flag to drop responses identified as error pages using ML-based detection.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The jarm output field is renamed to jarm_hash; any downstream parsers or pipelines referencing the jarm field will break.
12. v1.6.5 Jun 24, 2024 · release notes

    Adds -favicon flag to output favicon URL and MMH3 hash in JSON output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.5 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.6.5

    └──▷ TRY IT
    Retrieve the favicon URL for a target and extract it from JSON output.
    copy

    $ echo hackerone.com | ./httpx -favicon -j -silent | jq -r .favicon_url

13. v1.6.4 Jun 22, 2024 · release notes

    httpx-toolkit v1.6.4 adds -efqdn for subdomain extraction and -omit-body to exclude response body from output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.4 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.6.4

    • -efqdn extracts domain and subdomains from HTTP response headers and bodies
    • -sr (alias -omit-body) excludes the response body from the scan output

    2 details in Everything

14. v1.6.2 May 28, 2024 · release notes

    httpx v1.6.2 adds resolvers information to its output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.2 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.6.2

15. v1.6.1 May 19, 2024 · release notes

    Adds -protocol flag to force HTTP/1.1 connections

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.1 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.6.1

    └──▷ USE IT
    Force HTTP/1.1 protocol for compatibility with legacy servers.
    shell copy

    httpx -u https://example.com -pr http11

    • -protocol (-pr) flag for forcing http11 protocol
    • JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output now includes AAAA DNS type for IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.

    2 details in Everything

16. v1.6.0 Mar 6, 2024 · release notes

    Adds optional tech, cdn, and cdn_name fields to JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output; removes default hash field.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    └──▷ USE IT
    Scan targets and get technology detection details in JSONL format.
    shell copy

    httpx -u https://example.com -json -tech-detect=true

    Restore hash output alongside tech detection in JSONL format.
    shell copy

    httpx -u https://example.com -json -tech-detect=true -hash md5,mmh3

    • Adds tech, cdn, and cdn_name fields to JSONL output (optionally disabled with -tech-detect=false)
    • Removes default hash field from JSONL output (optionally enabled with -hash md5,mmh3)

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The hash field is no longer included in the default JSONL output; use -hash md5,mmh3 to restore it.
17. v1.3.8 Jan 15, 2024 · release notes

    httpx v1.3.8 adds -exclude, screenshot timeout, and headless options while removing old -ec flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.8 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.3.8

    └──▷ TRY IT
    Filter out CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. IPs and private ranges during scanning
    copy

    $ httpx -u https://example.com -e 'cdn,private-ips'

    Wait longer for a slow page to fully render its screenshot
    copy

    $ httpx -u https://slow-site.com -st 30

    Pass specific Chrome flags for headless enumeration
    copy

    $ httpx -u https://example.com -ho '--no-sandbox' -ho '--disable-gpu'

    • -exclude (alias -e) replaces -ec to exclude hosts matching cdn, private-ips, cidr, ip, or regex filters
    • -screenshot-timeout (alias -st) sets the screenshot capture timeout in seconds (default 10)
    • -headless-options (alias -ho) passes additional arguments to headless Chrome

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The old -ec option is removed; users must migrate to -exclude
18. v1.3.7 Nov 13, 2023 · release notes

    httpx v1.3.7 adds -eph flag to skip private IPs and SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. field in JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.7 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.3.7

    └──▷ USE IT
    Scan a target list but ignore any internal or RFC-1918 addresses to reduce noise and focus on external infrastructure.
    shell copy

    httpx -l targets.txt -eph

    • Adds -eph CLI flag to skip probing of private hosts/IPs during scanning
    • Adds SNI field to jsonl output format for HTTP responses

    2 details in Everything

19. v1.3.6 Oct 30, 2023 · release notes

    httpx v1.3.6 adds phash calculation for screenshots and visual recon clusters to JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.6 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.3.6

    • Adds phash (perceptual hash) field to screenshot data for deduplication and similarity detection
    • Adds visual_recon_clusters array to JSONL (-jsonl) output to group visually similar hosts

    2 details in Everything

20. v1.3.5 Sep 14, 2023 · release notes

    httpx v1.3.5 adds response body preview, HSTSHSTSAn HTTP response header, standardized in RFC 6797, that instructs browsers to contact a site over HTTPS only for a declared period, preventing protocol-downgrade and cookie-hijacking attacks. redirect handling, and JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. header inclusion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.5 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.3.5

    └──▷ TRY IT
    Preview the first 50 characters of the response body for quick content verification during mass scanning
    copy

    $ httpx -u https://example.com -body-preview 50

    Ensure redirects follow HSTS policies when crawling potential HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. enforcement scenarios
    copy

    $ httpx -u http://example.com -rhsts

    Include response headers in JSON output for detailed inspection of server configurations
    copy

    $ httpx -u https://example.com -json -irh | jq '.headers'

    • Adds -bp, -body-preview flag to display the first N characters of the response body (default 100)
    • Adds -rhsts, -respect-hsts flag to respect HSTS response headers for redirect requests
    • Adds -irh, -include-response-header flag to include HTTP response headers in JSON output (-json only)
    • Adds -ehb, -exclude-headless-body and -esb, -exclude-screenshot-bytes flags to exclude headless body and screenshot bytes from JSONL output

    4 details in Everything

21. v1.3.4 Jul 22, 2023 · release notes

    httpx v1.3.4 adds ML-based error page filtering (-fep), multi-format output (-oa), and custom config input (-config).

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.4 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.3.4

    └──▷ USE IT
    Scan targets but exclude pages identified as error pages by the ML classifier.
    shell copy

    httpx -u https://example.com -fep

    Save output in all available formats to a single file for comprehensive analysis.
    shell copy

    httpx -u https://example.com -oa results.jsonl

    Load configuration from a custom location instead of the default path.
    shell copy

    httpx -config /tmp/custom_httpx.yaml -u https://example.com

    • -fep flag enables ML-based error page detection and automatic filtering of responses.
    • -oa flag writes output results in all supported formats to a specified filename.
    • -config string flag allows specifying a custom path for the httpx configuration file.

    3 details in Everything

22. v1.3.3 Jun 21, 2023 · release notes

    httpx-toolkit v1.3.3 adds experimental TLS ClientHello randomization via -tls-impersonate

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.3 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.3.3

23. v1.3.2 Jun 13, 2023 · release notes

    Adds -no-stdin CLI flag to disable standard input processing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.2 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.3.2

    • Adds -no-stdin CLI option to bypass reading from standard input

    1 detail in Everything

24. v1.3.0 Apr 27, 2023 · release notes

    httpx-toolkit v1.3.0 adds -screenshot and -no-decode flags plus a stale.yml config file

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    └──▷ USE IT
    Capture screenshots of HTTP responses from subdomains found by subfinder to visualize application states or capture evidence.
    shell copy

    subfinder -d example.com | httpx -screenshot

    • Adds the -ss (or -screenshot) flag to capture and save screenshots of target URLs.
    • Adds the -no-decode flag to skip decoding processes when processing inputs.

    2 details in Everything

25. v1.2.9 Mar 14, 2023 · release notes

    Adds self-update option and version check support via CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.9 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.2.9

    • Adds --self-update flag to automatically update the cyber tooling binary

    1 detail in Everything

26. v1.2.6 Jan 6, 2023 · release notes

    httpx-toolkit v1.2.6 adds -delay flag, ztls support, base64 response output, and CSV BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. handling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.6 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.2.6

    └──▷ USE IT
    Throttle requests to avoid overwhelming the target server during active cyber tooling.
    shell copy

    httpx -u https://example.com -delay 500ms

    Enable ztls for connections requiring specific TLS handling or compatibility.
    shell copy

    httpx -u https://example.com -ztls

    • Adds -delay flag to control timing between HTTP requests (e.g., 200ms, 1s).
    • Adds -ztls option for TLS connections using ztls library.
    • Adds UTF-8 BOM to CSV output files.

    3 details in Everything

27. v1.2.5 Oct 29, 2022 · release notes

    httpx v1.2.5 adds ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. input support, DSL filtering, -u flag, tlsx integration, OnResult lib API, and memory profiling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.5 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.2.5

    └──▷ USE IT
    Probe a specific target using the new -u flag.
    shell copy

    httpx -u example.com

    Filter targets based on content length using the new DSL capabilities.
    shell copy

    echo 'example.com' | httpx -mdc "content_length > 1000 && content_length < 2000" -cl

    Pipe an ASN into httpx to discover associated HTTP services.
    shell copy

    echo AS15133 | httpx

    • Added -u CLI option to probe a single or multiple targets directly.
    • Added profile-mem flag for in-flight memory profiling.
    • Added ASN input support, allowing ASN values (e.g., AS15133) as input.
    • Added advanced DSL-based match/filter support via the -mdc option and DSL variables derived from JSON output keys.
    • Added tlsx integration for TLS probing.

    +2 more show less

    • Added OnResult options support, enabling httpx to be used as a library with result callbacks.
    • Added stored response directory path information to JSON output.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !JSON fields now use underscores (_) instead of dashes (-), breaking any tooling or scripts relying on the previous kebab-case field names.
28. v1.2.4 Jul 31, 2022 · release notes

    Adds connection pooling for JAARM and exposes the process object for advanced customization

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.4 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.2.4

    • Added support to expose the method process

    1 detail in Everything

29. v1.2.3 Jul 13, 2022 · release notes

    httpx v1.2.3 adds -health-check diagnostic, multiple -extract-regex, and JSON regex matches.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.3 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.2.3

    • Adds -health-check flag for self-diagnostics
    • Allows -extract-regex to be specified multiple times
    • Supports capturing regex matches in JSON output format

    3 details in Everything

30. v1.2.2 Jun 12, 2022 · release notes

    httpx v1.2.2 adds -mcdn, -fcdn, -mrt, -frt, -sni flags for CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. matching/filtering, response time filtering, and custom TLS SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.2 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.2.2

    • Adds -mcdn / -match-cdn flag to match hosts against specified CDN providers (oracle, google, azure, cloudflare, cloudfront, fastly, incapsula, akamai, sucuri, leaseweb).
    • Adds -fcdn / -filter-cdn flag to filter hosts based on specified CDN providers.
    • Adds -mrt / -match-response-time flag to match responses with a specified response time in seconds (e.g., -mrt '< 1').
    • Adds -frt / -filter-response-time flag to filter responses based on a specified response time in seconds (e.g., -frt '> 1').
    • Adds -sni / -sni-name flag to specify a custom TLS SNI name.

    5 details in Everything

31. v1.2.1 Apr 8, 2022 · release notes

    httpx v1.2.1 adds -jarm and -asn flags for TLS/JARM and ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. fingerprinting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.1 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.2.1

    └──▷ TRY IT
    Scan a host for its JARM fingerprint to identify the underlying TLS stack and cipher suite configuration.
    copy

    $ echo 'example.com' | httpx -jarm -silent

32. v1.2.0 Mar 1, 2022 · release notes

    httpx v1.2.0 adds multiple hash outputs, CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. name display, rate limiting and stats interval flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    └──▷ USE IT
    Scan a target while limiting requests to 10 per minute and outputting MD5/SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashes in JSON format
    shell copy

    httpx -u https://example.com -json -hash md5,sha256 -rlm 10 -o results.json

    Adjust how often stats updates are printed during a scan (e.g., every 10 seconds instead of default 5)
    shell copy

    httpx -l targets.txt -si 10

    • Adds -hash flag supporting md5, mmh3, simhash, sha1, sha256, and sha512 for displaying response body hashes
    • Adds -rlm, -rate-limit-minute flag to limit requests per minute
    • Adds -si, -stats-interval flag to control statistics display frequency
    • Adds CDN service name display capability
    • Adds euc-kr charset support

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !JSON output no longer includes separate body-sha256 and header-sha256 fields; hashes are now nested under the hashes object with keys like body-md5, header-sha256, etc.
33. v1.1.5 Jan 10, 2022 · release notes

    httpx v1.1.5 adds favicon, word count, and line count matchers plus custom resolver support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.5 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.1.5

    • Adds -ffc (favicon hash filter) and -mfc (favicon hash matcher) flags to probe and filter responses by favicon hash
    • Adds -fwc (word count filter) and -mwc (word count matcher) flags for response body word counting
    • Adds -flc (line count filter) and -mlc (line count matcher) flags for response line counting
    • Adds -r flag to specify custom resolver/s for DNS resolution

    4 details in Everything

34. v1.1.4 Dec 1, 2021 · release notes

    Adds probe-all-ips flag to scan all host IPs and debug flags for request/response dumping

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.4 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.1.4

    └──▷ TRY IT
    Probe every IP associated with a host instead of just the resolved A record.
    copy

    $ httpx -u https://example.com -probe-all-ips

    Dump raw request/response data to stdout for debugging probes.
    copy

    $ httpx -u https://example.com -debug-resp

    • probe-all-ips flag added to probe all the ips associated with same host
    • Debug/Request dump support via debug, debug-req and debug-resp flags

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tech flag is now td
35. v1.1.3 Oct 10, 2021 · release notes

    httpx-toolkit v1.1.3 adds -stream, -csv, and goflags integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.3 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.1.3

    • Adds -stream flag for streaming input support to process large lists without loading them entirely into memory
    • Adds -csv flag to enable CSV output format alongside existing JSON/text options

    2 details in Everything

36. v1.1.2 Aug 26, 2021 · release notes

    New CLI flags for controlling redirects, host errors, allow/deny lists, and request methods in httpx-toolkit v1.1.2

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.2 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.1.2

    └──▷ TRY IT
    Load target URLs and allow/deny lists from files for batch processing.
    copy

    $ httpx-toolkit -l targets.txt -allow allowed.txt -deny blocked.txt

    • -max-host-error flag to skip hosts exceeding the error threshold
    • -max-redirects flag to limit the number of following redirects
    • allow and deny flags now accept comma-separated values or file paths for list inputs
    • x flag gains case-insensitive input support for request methods

    4 details in Everything

37. v1.1.1 Aug 9, 2021 · release notes

    httpx v1.1.1 adds pause/resume, rate-limiting, and extended probe data in JSON output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.1 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.1.1

    └──▷ USE IT
    Pause a long-running scan and resume it later with the same state.
    shell copy

    httpx -u https://example.com --pause
    # ... later ...
    httpx -u https://example.com --resume

    Throttle scan rate and limit saved response size to reduce bandwidth usage.
    shell copy

    httpx -L targets.txt --rate-limit 100 --response-size-to-save 50000

    • Adds --pause and --resume flags to stop and restart an active scan without losing state
    • Adds --rate-limit flag to throttle outgoing requests during scans
    • Adds --response-size-to-save flag to control the maximum size of body content saved in output
    • JSON output now includes probe status and original input data for each result
    • Adds --exclude-cdn support when used with port-specific flags to skip known CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. infrastructure

    5 details in Everything

38. v1.0.7 May 26, 2021 · release notes

    httpx v1.0.7 adds URL following for 307/308 redirects, followed URL printing, TLS fingerprint hashes in JSON, and respects user-defined HTTP schemas.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.7 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.0.7

    • Adds support to follow 307 and 308 based redirects
    • Adds the ability to print followed URLs in the output
    • Adds TLS fingerprint hash information in the JSON output
    • Adds support to respect user-defined HTTP schema in the input

    4 details in Everything

39. v1.0.6 May 6, 2021 · release notes

    Adds allow/deny flags for IP filtering, store-chain and follow-redirects for redirect handling, glob input support, extract-regex, and max-response-body-size

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.6 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.0.6

    └──▷ USE IT
    Probe a list of domains but exclude an internal range and only store redirect history for analysis.
    shell copy

    httpx -l targets.txt -allow 192.168.1.0/24 -deny 10.0.0.0/8 -store-chain

    Extract specific tokens from HTTP responses for further processing.
    shell copy

    httpx -u https://example.com -extract-regex 'key=([a-zA-Z0-9]+)'

    Use glob patterns to scan all files in a directory for hostnames.
    shell copy

    httpx -l "subdomains-to-probe/*"

    • Adds allow flag to whitelist IPs/CIDRs for probing.
    • Adds deny flag to block IPs/CIDRs for probing.
    • Added support to store redirect chain data with store-chain flag
    • Added support to display redirect chain with follow-redirects flag
    • Added glob support to read multiple files as input (-l "subdomains-to-probe/*")

    +2 more show less

    • Added max-response-body-size flag to define max response body size.
    • Added extract-regex flag to print custom strings from response to CLI.

    7 details in Everything

40. v1.0.5 Apr 10, 2021 · release notes

    Adds technology detection (-tech-detect), file-based paths input (-paths), and random user agent support (-random-agent) to httpx v1.0.5

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.5 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.0.5

    └──▷ TRY IT
    Scan a list of URLs from a file and detect technologies with randomized User-Agent headers.
    copy

    $ httpx -paths ./targets.txt -tech-detect -random-agent

    Retrieve JSON output including the new body and header hashes for further analysis.
    copy

    $ httpx -u https://example.com -include-response | jq '.body-sha256, .header-sha256'

    • Adds timestamp, request,scheme,port, path, body_sha256, header_sha256 fields to JSON output
    • Adds -tech-detect flag for wappalyzergo based technology detection

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !response-in-json is now deprecated and replaced by include-response
    • !tls-grab is now optional instead of default
    • !serverResponse field is renamed to response-body in JSON output
    • !ip field is renamed to host in JSON output
    • !ips field is renamed to a in JSON output
    • !tls field is renamed to tlsgrab in JSON output
41. v1.0.3 Nov 17, 2020 · release notes

    httpx-toolkit v1.0.3 adds -stats, -no-fallback, -unsafe, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support and hmap deduplication

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.3 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.0.3

    └──▷ TRY IT
    Monitor long-running scans in the terminal without waiting for output
    copy

    $ httpx -u targets.txt -stats

    Stop scanning HTTP if HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. is already available, saving time on modern sites
    copy

    $ httpx -u targets.txt -no-fallback

    Map custom ports and schemes for non-standard services
    copy

    $ httpx -u targets.txt -ports http:8080 https:9443

    • - Add progress bar via -stats flag to track scan status
    • - Add automatic HTTPS fallback skip with -no-fallback flag
    • - Enable custom port/scheme mapping using -ports http:443 https:8443 format
    • - Add response time measurement with -response-time flag
    • - Enable raw HTTP protocol support via -unsafe flag

    +2 more show less

    • - Add native IPv6 host resolution and targeting
    • - Integrate hmap library for input deduplication

    7 details in Everything

42. v1.0.2 Sep 22, 2020 · release notes

    Adds IP, CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin., and CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. extraction plus string/regex match/filter capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.2 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.0.2

    • Added IP extraction to capture target IP addresses during scanning
    • Added CNAME extraction to identify canonical names for targets
    • Added CDN check functionality to detect if a target uses a CDN
    • Added string-based match/filter capabilities for response analysis
    • Added regex-based match/filter capabilities for response analysis

    5 details in Everything

43. v1.0.0 Aug 30, 2020 · release notes

    Adds --http2, --raw, --unsafe, new output headers, and multi-verb probing to httpx-toolkit v1.0.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    └──▷ TRY IT
    Probe a target over HTTP/2 to detect protocol support.
    copy

    $ httpx-toolkit -u https://example.com --http2

    Send a specific RAW request file with custom Host header and raw transmission.
    copy

    $ httpx-toolkit -raw request.txt --unsafe

    Test multiple HTTP verbs against a host simultaneously.
    copy

    $ httpx-toolkit -u https://example.com -m GET,HEAD,POST

    • --http2 flag for HTTP/2 probing capability
    • --pipeline flag for experimental HTTP/1.1 pipeline probing
    • location field in output JSON derived from Location headers
    • CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. data extraction into output for security posture analysis
    • -raw <file> argument to process RAW requests from disk

    +2 more show less

    • --unsafe flag enabling raw HTTP request transmission via RawHTTP
    • -m <verbs> support for multi-method/verb probing in a single run

    7 details in Everything

44. v0.0.7 Jul 30, 2020 · release notes

    httpx-toolkit v0.0.7 adds output matchers/filters, content-type output, TLS probe, and request file input.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.7 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v0.0.7

    • Adds match and filter flags to select hosts by HTTP response patterns
    • Adds -tls-probe flag to enable TLS certificate and protocol analysis
    • Adds -r <file> flag to read targets from a file instead of standard input

    3 details in Everything

45. v0.0.3 Jun 15, 2020 · release notes

    httpx-toolkit v0.0.3 adds CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. input, colored output, HTTP fingerprinting, Docker support, raw JSON responses, and same-host redirects.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.3 https://github.com/projectdiscovery/httpx.git
    # already have the repo? check out this version:
    $ git checkout v0.0.3

    • Adds --cidr flag to accept CIDR notation input for scanning
    • Adds color output support via terminal color flags
    • Adds Docker image support for containerized usage
    • Adds option to include raw response body in JSON output

    4 details in Everything