Discovery
Fetch the same paths across many hosts without flooding them
Fetch many paths across many hosts while staying polite per host.
overview
What meg does
Give meg a hosts file and either a path or a paths file. -d sets milliseconds between requests to the same host; -c sets concurrency. -s keeps only matching status codes.
Use it when you want the same handful of paths across hundreds of hosts and need raw responses on disk for later grep. Ordering fetches one path across all hosts before the next path.
httpx probes liveness and metadata. ffuf exhausts paths on one host. meg spreads a small path set across many hosts and writes a response folder.
source github.com/tomnomnom/meg
use cases
Where meg fits
Hunt one path across an entire estate
Request a single sensitive path, such as /.git/config or /actuator, across every host in scope and save the responses so you can grep for the ones that returned content.
Sweep many paths politely at scale
Feed a paths file and a hosts file, then let meg interleave requests across hosts so a large content-discovery sweep spreads load instead of pounding any single server.
Filter to interesting responses only
Save only responses with a specific status code so the output folder holds the hits worth reviewing rather than every 404, keeping triage fast on a wide run.
Run behind discovery and probing
Place meg after subdomain enumeration and an httpx probe so it fetches against live hosts only, then pass its response folder to downstream grep or extraction stages.
reference
meg inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| hosts-file | FILE | · | Line-by-line hosts with a protocol, the usual pipeline input from discovery. |
| paths-file | FILE | · | File of paths to request, one per line, fetched against every host. |
| path | STRING | · | Request a single path directly as an argument instead of a paths file (use one or the other). |
| delay | STRING | -d | Milliseconds between requests to the same host (default 5000), the lever that keeps a sweep polite. |
| concurency | STRING | -c | Concurrency level across hosts (default 20). |
| save-only-responses | STRING | -s | Save only responses with a specific status code, so the output folder holds the hits. |
| http-method | STRING | -X | HTTP method for each request (default GET). |
| custom-header | STRING | -H | Send a custom HTTP header with every request. |
Showing key inputs. meg exposes 12 inputs in total.
Full flag reference (12 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| path | STRING | · | If you want to request just one path, you can specify it directly as an argument. You should use path or paths-file, arguments excludes one other. |
| delay | STRING | -d | Milliseconds between requests to the same host (default: 5000) |
| concurency | STRING | -c | Set the concurrency level (defaut: 20) |
| hosts-file | FILE | · | Line by line hosts with a protocol |
| paths-file | FILE | · | File with line by line paths |
| http-method | STRING | -X | HTTP method (default: GET) |
| http-timeout | STRING | -t | Set the HTTP timeout (default: 10000) |
| request-body | STRING | -b | Set the request body |
| custom-header | STRING | -H | Send a custom HTTP header |
| rawhttp-library | BOOLEAN | -r | Use the rawhttp library for requests (experimental) |
| follow-redirects | BOOLEAN | -L | Follow redirects / location header |
| save-only-responses | STRING | -s | Save only responses with specific status code |
example
Run meg
# fetch /.git/config across live hosts; 2s delay, keep only HTTP 200smeg -d 2000 -c 20 -s 200 -H "User-Agent: meg" /.git/config hosts.txthttps://www.example.com/.git/config (200 OK) -> out/www.example.com/_.git_confighttps://app.example.com/.git/config (404) skipped (-s 200)https://api.example.com/.git/config (200 OK) -> out/api.example.com/_.git_confighttps://staging.example.com/.git/config (403) skipped (-s 200)https://dev.example.com/.git/config (200 OK) -> out/dev.example.com/_.git_confighttps://mail.example.com/.git/config (404) skipped (-s 200)https://vpn.example.com/.git/config (200 OK) -> out/vpn.example.com/_.git_configdone: 4/7 savedguidance
Choosing meg
Use meg when you want the same paths across many hosts and raw responses for review, without battering any single server. For liveness and metadata rather than saved bodies, use httpx. For templated vulnerability checks, use nuclei.
httpx
Probes hosts for status, title, and tech. Use it to find live hosts before meg fetches paths against them.
ffuf
Fast per-host content fuzzer. Better for exhausting one host's paths; meg spreads a few paths across many hosts.
nuclei
Template-based scanner. Tests for known issues rather than saving raw responses for manual grepping.
faq
meg questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run meg yourself
A host list is probed by httpx, the live hosts feed meg, which fetches a set of paths across all of them and writes the saved responses as a folder to review.
Facts on this page come from the live Trickest tool library.