Updated Jul 15, 2026
Discovery
Package live-host screenshots into one zip archive
Capture web host screenshots with httpx and export them as a zip.
overview
What httpx-screenshot-zip does
httpx-screenshot-zip runs httpx with headless capture enabled, then packs every screenshot into one zip. Instead of a folder of loose images, you get a single artifact to download or attach to a report, while probe context such as status and title can still accompany the run.
Read hosts from -list or -target. Control idle time with -screenshot-idle, cap slow pages with -screenshot-timeout, choose viewport-only via -no-screenshot-full-page, and pass extra Chrome options with -headless-options. Matchers still limit which responses get archived.
Trickest runs it as a managed Discovery node that writes a file and a folder with the screenshots packaged as a zip. Place it after a live-host probe when the deliverable is a portable gallery rather than loose files.
use cases
Where httpx-screenshot-zip fits
Produce a portable screenshot gallery
Capture every live host and export the images as one zip so the result is a single artifact to download or attach to a report.
Hand off recon visuals
Bundle screenshots into an archive a teammate or client can open without navigating a folder tree of loose files.
Triage at scale, then package
Screenshot hundreds of live hosts for visual triage and ship the whole set as a compressed deliverable.
Tune capture for accurate shots
Set the idle time and screenshot timeout so dynamic and slow pages render fully before being zipped.
reference
httpx-screenshot-zip inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| list | FILE | -list | Input file containing the list of hosts to process. |
| target | STRING | -target | Input target host(s) to probe. |
| screenshot-idle | STRING | -screenshot-idle | Idle time before taking the screenshot, in seconds (default 1s). |
| screenshot-timeout | STRING | -screenshot-timeout | Timeout for the screenshot in seconds (default 10). |
| no-screenshot-full-page | BOOLEAN | -no-screenshot-full-page | Disable saving the full-page screenshot; capture the viewport only. |
| headless-options | STRING | -headless-options | Start headless Chrome with additional options. |
| threads | STRING | -threads | Number of threads to use (default 50). |
| title | BOOLEAN | -title | Display page title alongside probe results. |
Showing key inputs. httpx-screenshot-zip exposes 123 inputs in total.
Full flag reference (123 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| x | STRING | -x | request methods to probe, use 'all' to probe all HTTP methods |
| ip | BOOLEAN | -ip | display host ip |
| asn | BOOLEAN | -asn | display host asn information |
| cdn | BOOLEAN | -cdn | display cdn in use |
| csv | BOOLEAN | -csv | store output in csv format |
| body | FILE | -body | post body to include in http request |
| deny | STRING | -deny | denied list of IP/CIDR's to process (comma separated) |
| hash | STRING | -hash | display response body hash (supported: md5,mmh3,simhash,sha1,sha256,sha512) |
| jarm | BOOLEAN | -jarm | display jarm fingerprint hash |
| json | BOOLEAN | -json | store output in JSONL(ines) format |
| list | FILE | -list | input file containing list of hosts to process |
| path | STRING | -path | path or list of paths to probe (comma-separated) |
| ztls | BOOLEAN | -ztls | use ztls library with autofallback to standard one for tls13 |
| allow | STRING | -allow | allowed list of IP/CIDR's to process (comma separated) |
| cname | BOOLEAN | -cname | display host cname |
| debug | BOOLEAN | -debug | display request/response content in cli |
| delay | STRING | -delay | duration between each http request (eg: 200ms, 1s) (default -1ns) |
| http2 | BOOLEAN | -http2 | probe and display server supporting HTTP2 |
| ports | STRING | -ports | ports to probe (nmap syntax: eg http:1,2-10,11,https:80) |
| probe | BOOLEAN | -probe | display probe status |
| stats | BOOLEAN | -stats | display scan statistic |
| title | BOOLEAN | -title | display page title |
| trace | BOOLEAN | -trace | trace |
| vhost | BOOLEAN | -vhost | probe and display server supporting VHOST |
| config | FILE | -config | path to the httpx configuration file |
| header | STRING | -header | custom http headers to send with request |
| method | BOOLEAN | -method | display http request method |
| silent | BOOLEAN | -silent | silent mode |
| target | STRING | -target | input target host(s) to probe |
| unsafe | BOOLEAN | -unsafe | send raw requests skipping golang normalization |
| exclude | STRING | -exclude | exclude host matching specified filter ('cdn', 'private-ips', cidr, ip, regex) |
| favicon | BOOLEAN | -favicon | display mmh3 hash for '/favicon.ico' file |
| request | FILE | -request | file containing raw request |
| retries | STRING | -retries | number of retries |
| threads | STRING | -threads | number of threads to use (default 50) |
| timeout | STRING | -timeout | timeout in seconds (default 5) |
| verbose | BOOLEAN | -verbose | verbose mode |
| location | BOOLEAN | -location | display response redirect location |
| pipeline | BOOLEAN | -pipeline | probe and display server supporting HTTP1.1 pipeline |
| protocol | STRING | -protocol | protocol to use (unknown, http11) |
| sni-name | STRING | -sni-name | custom TLS SNI name |
| tls-grab | BOOLEAN | -tls-grab | perform TLS(SSL) data grabbing |
| csp-probe | BOOLEAN | -csp-probe | send http probes on the extracted CSP domains |
| debug-req | BOOLEAN | -debug-req | display request content in cli |
| deny-list | FILE | -deny | denied list of IP/CIDR's to process |
| match-cdn | STRING | -match-cdn | match host with specified cdn provider (azure, cloudflare, cloudfront, fastly, incapsula, oracle, google, sucuri, leaseweb, akamai) |
| no-decode | BOOLEAN | -no-decode | avoid decoding body |
| omit-body | BOOLEAN | -omit-body | omit response body in output |
| path-list | FILE | -path | list of paths to probe |
| resolvers | STRING | -resolvers | list of custom resolvers (comma separated) |
| tls-probe | BOOLEAN | -tls-probe | send http probes on the extracted TLS domains (dns_name) |
| websocket | BOOLEAN | -websocket | display server using websocket |
| allow-list | FILE | -allow | allowed list of IP/CIDR's to process |
| debug-resp | BOOLEAN | -debug-resp | display response content in cli |
| filter-cdn | STRING | -filter-cdn | filter host with specified cdn provider (azure, cloudflare, cloudfront, fastly, incapsula, oracle, google, sucuri, leaseweb, akamai) |
| http-proxy | STRING | -http-proxy | http proxy to use (eg http://127.0.0.1:8080) |
| line-count | BOOLEAN | -line-count | display response body line count |
| match-code | STRING | -match-code | match response with specified status code (-mc 200,302) |
| rate-limit | STRING | -rate-limit | maximum requests to send per second (default 150) |
| web-server | BOOLEAN | -web-server | display server name |
| word-count | BOOLEAN | -word-count | display response body word count |
| filter-code | STRING | -filter-code | filter response with specified status code (-fc 403,401) |
| header-file | FILE | -header-file | custom http headers to send with request |
| match-regex | STRING | -match-regex | match response with specified regex (-mr admin) |
| no-fallback | BOOLEAN | -no-fallback | display both probed protocol (HTTPS and HTTP) |
| status-code | BOOLEAN | -status-code | display response status-code |
| store-chain | BOOLEAN | -store-chain | include http redirect chain in responses (-sr only) |
| tech-detect | BOOLEAN | -tech-detect | display technology in use based on wappalyzer dataset |
| vhost-input | BOOLEAN | -vhost-input | get a list of vhosts as input |
| body-preview | BOOLEAN | -body-preview | display first N characters of response body (default 100) |
| content-type | BOOLEAN | -content-type | display response content-type |
| extract-fqdn | BOOLEAN | -extract-fqdn | get domain and subdomains from response body and header in jsonl/csv output |
| filter-regex | STRING | -filter-regex | filter response with specified regex (-fe admin) |
| health-check | BOOLEAN | -health-check | run diagnostic check up |
| match-length | STRING | -match-length | match response with specified content length (-ml 100,102) |
| match-string | STRING | -match-string | match response with specified string (-ms admin) |
| random-agent | BOOLEAN | -random-agent | enable Random User-Agent to use (default true) |
| respect-hsts | BOOLEAN | -respect-hsts | respect HSTS response headers for redirect requests |
| extract-regex | STRING | -extract-regex | display response content with matched regex |
| filter-length | STRING | -filter-length | filter response with specified content length (-fl 23,33) |
| filter-string | STRING | -filter-string | filter response with specified string (-fs admin) |
| include-chain | BOOLEAN | -include-chain | include redirect http chain in JSON output (-json only) |
| match-favicon | STRING | -match-favicon | match response with specified favicon hash (-mfc 1494302000) |
| max-redirects | STRING | -max-redirects | max number of redirects to follow per host (default 10) |
| probe-all-ips | BOOLEAN | -probe-all-ips | probe all the ips associated with same host |
| response-time | BOOLEAN | -response-time | display response time |
| content-length | BOOLEAN | -content-length | display response content-length |
| extract-preset | STRING | -extract-preset | display response content matched by a pre-defined regex (url,ipv4,mail) |
| filter-favicon | STRING | -filter-favicon | filter response with specified favicon hash (-mfc 1494302000) |
| max-host-error | STRING | -max-host-error | max error count per host before skipping remaining path/s (default 30) |
| resolvers-file | FILE | -resolvers | list of custom resolvers |
| stats-interval | STRING | -stats-interval | number of seconds to wait between showing a statistics update (default: 5) |
| store-response | BOOLEAN | -store-response | store http response to output directory |
| match-condition | STRING | -match-condition | match response with dsl expression condition |
| screenshot-idle | STRING | -screenshot-idle | set idle time before taking screenshot in seconds (default 1s) |
| tls-impersonate | BOOLEAN | -tls-impersonate | enable random tls client (ja3) impersonation (experimental) |
| filter-condition | STRING | -filter-condition | filter response with dsl expression condition |
| follow-redirects | BOOLEAN | -follow-redirects | follow http redirects |
| headless-options | STRING | -headless-options | start headless chrome with additional options |
| include-response | BOOLEAN | -include-response | include http request/response in JSON output (-json only) |
| match-line-count | STRING | -match-line-count | match response body with specified line count (-mlc 423,532) |
| match-word-count | STRING | -match-word-count | match response body with specified word count (-mwc 43,55) |
| filter-duplicates | BOOLEAN | -filter-duplicates | filter out near-duplicate responses (only first response is retained) |
| filter-error-page | BOOLEAN | -filter-error-page | filter response with ML based error page detection |
| filter-line-count | STRING | -filter-line-count | filter response body with specified line count (-flc 423,532) |
| filter-word-count | STRING | -filter-word-count | filter response body with specified word count (-fwc 423,532) |
| rate-limit-minute | STRING | -rate-limit-minute | maximum number of requests to send per minute |
| list-dsl-variables | BOOLEAN | -list-dsl-variables | list json output field keys name that support dsl matcher/filter |
| no-fallback-scheme | BOOLEAN | -no-fallback-scheme | probe with protocol scheme specified in input |
| screenshot-timeout | STRING | -screenshot-timeout | set timeout for screenshot in seconds (default 10) |
| csv-output-encoding | STRING | -csv-output-encoding | define output encoding |
| leave-default-ports | BOOLEAN | -leave-default-ports | leave default http/https ports in host header (eg. http://host:80 - https//host:443 |
| match-response-time | STRING | -match-response-time | match response with specified response time in seconds (-mrt '< 1') |
| filter-response-time | STRING | -filter-response-time | filter response with specified response time in seconds (-frt '> 1') |
| exclude-headless-body | BOOLEAN | -exclude-headless-body | enable excluding headless header from json output |
| follow-host-redirects | BOOLEAN | -follow-host-redirects | follow redirects on the same host |
| response-size-to-read | STRING | -response-size-to-read | max response size to read in bytes (default 2147483647) |
| response-size-to-save | STRING | -response-size-to-save | max response size to save in bytes (default 2147483647) |
| include-response-base64 | BOOLEAN | -include-response-base64 | include base64 encoded http request/response in JSON output (-json only) |
| include-response-header | BOOLEAN | -include-response-header | include http response (headers) in JSON output (-json only) |
| no-screenshot-full-page | BOOLEAN | -no-screenshot-full-page | disable saving full page screenshot |
| exclude-screenshot-bytes | BOOLEAN | -exclude-screenshot-bytes | enable excluding screenshot bytes from json output |
| store-vision-recon-cluster | BOOLEAN | -store-vision-recon-cluster | include visual recon clusters (-ss and -sr only) |
example
Run httpx-screenshot-zip
# probe hosts, capture screenshots, package for handoffhttpx -list hosts.txt -title -screenshot-idle 2 -screenshot-timeout 15 -threads 25 -no-screenshot-full-pagehttps://www.example.com [200] [Example Domain]https://app.example.com [200] [App Login]https://api.example.com [401] [Unauthorized]https://staging.example.com [200] [Staging]http://198.51.100.24 [302] []https://dev.example.com:8443 [200] [Dev Portal]screenshots written; archive ready as screenshots.zip6 hosts capturedguidance
Choosing httpx-screenshot-zip
Use httpx-screenshot-zip when the deliverable is a single packaged gallery. For browsing screenshots as loose files, httpx-screenshot is the same capture without the archive. For metadata-only probing, plain httpx is lighter.
httpx-screenshot
Same capture engine, screenshots left as loose files instead of a zip archive.
httpx
Probing without rendering. Prefer it when you only need status, title, and tech, not images.
aquatone
Classic screenshot-and-report tool. This node keeps probing, capture, and packaging in one step.
faq
httpx-screenshot-zip questions
It bundles every screenshot into one archive, so the output is a single portable artifact instead of a folder of loose image files.
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run httpx-screenshot-zip yourself
A hosts list is probed by httpx, then httpx-screenshot-zip captures each live host and writes the screenshots as a single zip archive output.
Facts on this page come from the live Trickest tool library.