loading
Loading content
loading
Network
Takes a list of domains and probes for working HTTP and HTTPS servers.
overview
httprobe answers one question well: which domains in a list have a web server answering? Give it a file of domains and it tests each for HTTP on port 80 and HTTPS on port 443, printing the schemes that respond. That tight scope makes it fast and dependency-free, a clean filter to sit between subdomain discovery and anything that needs live hosts.
It stays deliberately minimal. You can raise concurrency with the threads flag, set a timeout, prefer HTTPS to skip the HTTP check when TLS already answers, and add extra protocol:port probes for services on non-standard ports. There is no tech detection or response parsing here, which is the point: httprobe does liveness and hands off.
On Trickest, httprobe is a Network node that reads a domains file and writes a file and a folder of live URLs. Drop it after subfinder to thin a large subdomain list down to what responds, then pass the survivors to a richer prober or a scanner.
use cases
Run httprobe over subfinder output to keep only the domains with a web server answering, cutting dead weight before scanning.
Probe port 80 and 443 across thousands of domains in one fast pass to learn which schemes each host serves.
Add protocol:port probes with -p to catch web services running off 80 and 443 without switching tools.
Use --prefer-https to skip the HTTP check when TLS already responds, halving requests on a large list.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domains | FILE | · | List of domains to probe, one per line, read from standard input. |
| threads | STRING | -c | Number of concurrent workers (default 20). |
| timeout | STRING | -t | Per-request timeout in milliseconds (default 10000). |
| prefer-https | BOOLEAN | --prefer-https | Skip the HTTP check when HTTPS already responds. |
| protocol-port | STRING | -p | Add an extra probe for a protocol:port pair beyond the defaults, e.g. http:8080. |
| skip-standard-ports | BOOLEAN | -s | Skip the default HTTP:80 and HTTPS:443 probes and test only the ports you name. |
Showing key inputs. httprobe exposes 7 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| domains | FILE | · | List of domains to probe, one per line, read from standard input. |
| threads | STRING | -c | Number of concurrent workers (default 20). |
| timeout | STRING | -t | Per-request timeout in milliseconds (default 10000). |
| prefer-https | BOOLEAN | --prefer-https | Skip the HTTP check when HTTPS is already working. |
| protocol-port | STRING | -p | Add an extra probe for a protocol:port pair beyond the port 80 and port 443 defaults, e.g. http:8080. |
| protocol-port-2 | STRING | -p | A second protocol:port slot for adding another non-standard port to probe. |
| skip-standard-ports | BOOLEAN | -s | Skip the default HTTP:80 and HTTPS:443 probes and test only the protocol:port pairs you specify. |
example
# probe a subdomain list for live HTTP and HTTPS, 50 concurrent workers, add port 8443cat subdomains.txt | httprobe -c 50 -t 3000 -p https:8443https://api.example.comhttp://app.example.comhttps://app.example.comhttps://staging.example.comhttp://dev.example.comhttps://mail.example.comhttps://vpn.example.comhttps://gitlab.example.com:8443guidance
Use httprobe when you just need to know which domains are live over HTTP or HTTPS, fast. When you also want status, title, and tech in the same pass, httpx returns far more signal per request.
Probes liveness plus status, title, tech, and TLS in one pass. More signal, heavier than httprobe.
Discovers the subdomains httprobe then filters. Runs before it, not instead of it.
Another tomnomnom tool that takes a host list and fetches them over HTTP. Pulls many paths per host where httprobe only checks liveness.
faq
related
Quickly map an organization's network ranges using ASN information.
Maximize your resolver count by combining the target's DNS servers with public resolvers.
Expand CIDR ranges into a list of IP addresses easily.
Expand CIDR ranges into a list of IP addresses easily, from a file.
Maintain a list of IPv4 DNS servers verified against baseline servers for accurate responses.
Patched dnsvalidator that keeps only IPv4 resolvers verified against baseline servers.
A domain feeds subfinder, whose subdomains httprobe filters down to the live HTTP and HTTPS hosts before they land as a queryable output.
Facts on this page come from the live Trickest tool library.