loading
Loading content
loading
Discovery
Fetch many paths across many hosts while staying polite per host.
overview
Give meg a hosts file and either a path or a paths file. -d sets milliseconds between requests to the same host; -c sets concurrency. -s keeps only matching status codes.
Use it when you want the same handful of paths across hundreds of hosts and need raw responses on disk for later grep. Ordering fetches one path across all hosts before the next path.
httpx probes liveness and metadata. ffuf exhausts paths on one host. meg spreads a small path set across many hosts and writes a response folder.
source github.com/tomnomnom/meg
use cases
Request a single sensitive path, such as /.git/config or /actuator, across every host in scope and save the responses so you can grep for the ones that returned content.
Feed a paths file and a hosts file, then let meg interleave requests across hosts so a large content-discovery sweep spreads load instead of pounding any single server.
Save only responses with a specific status code so the output folder holds the hits worth reviewing rather than every 404, keeping triage fast on a wide run.
Place meg after subdomain enumeration and an httpx probe so it fetches against live hosts only, then pass its response folder to downstream grep or extraction stages.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| hosts-file | FILE | · | Line-by-line hosts with a protocol, the usual pipeline input from discovery. |
| paths-file | FILE | · | File of paths to request, one per line, fetched against every host. |
| path | STRING | · | Request a single path directly as an argument instead of a paths file (use one or the other). |
| delay | STRING | -d | Milliseconds between requests to the same host (default 5000), the lever that keeps a sweep polite. |
| concurency | STRING | -c | Concurrency level across hosts (default 20). |
| save-only-responses | STRING | -s | Save only responses with a specific status code, so the output folder holds the hits. |
| http-method | STRING | -X | HTTP method for each request (default GET). |
| custom-header | STRING | -H | Send a custom HTTP header with every request. |
Showing key inputs. meg exposes 12 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| path | STRING | · | If you want to request just one path, you can specify it directly as an argument. You should use path or paths-file, arguments excludes one other. |
| delay | STRING | -d | Milliseconds between requests to the same host (default: 5000) |
| concurency | STRING | -c | Set the concurrency level (defaut: 20) |
| hosts-file | FILE | · | Line by line hosts with a protocol |
| paths-file | FILE | · | File with line by line paths |
| http-method | STRING | -X | HTTP method (default: GET) |
| http-timeout | STRING | -t | Set the HTTP timeout (default: 10000) |
| request-body | STRING | -b | Set the request body |
| custom-header | STRING | -H | Send a custom HTTP header |
| rawhttp-library | BOOLEAN | -r | Use the rawhttp library for requests (experimental) |
| follow-redirects | BOOLEAN | -L | Follow redirects / location header |
| save-only-responses | STRING | -s | Save only responses with specific status code |
example
# fetch /.git/config across live hosts; 2s delay, keep only HTTP 200smeg -d 2000 -c 20 -s 200 -H "User-Agent: meg" /.git/config hosts.txthttps://www.example.com/.git/config (200 OK) -> out/www.example.com/_.git_confighttps://app.example.com/.git/config (404) skipped (-s 200)https://api.example.com/.git/config (200 OK) -> out/api.example.com/_.git_confighttps://staging.example.com/.git/config (403) skipped (-s 200)https://dev.example.com/.git/config (200 OK) -> out/dev.example.com/_.git_confighttps://mail.example.com/.git/config (404) skipped (-s 200)https://vpn.example.com/.git/config (200 OK) -> out/vpn.example.com/_.git_configdone: 4/7 savedguidance
Use meg when you want the same paths across many hosts and raw responses for review, without battering any single server. For liveness and metadata rather than saved bodies, use httpx. For templated vulnerability checks, use nuclei.
Probes hosts for status, title, and tech. Use it to find live hosts before meg fetches paths against them.
Fast per-host content fuzzer. Better for exhausting one host's paths; meg spreads a few paths across many hosts.
Template-based scanner. Tests for known issues rather than saving raw responses for manual grepping.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A host list is probed by httpx, the live hosts feed meg, which fetches a set of paths across all of them and writes the saved responses as a folder to review.
Facts on this page come from the live Trickest tool library.