Recon
Grab full HTTP banners after a port scan
zgrab2 HTTP module for structured banner grabs.
overview
What zgrab2-http does
Feed open web ports from zmap or naabu into zgrab2-http when you need full response JSON rather than a crawler pass.
Shape each grab with --port, --method, --endpoint, --senders, --use-https, and --max-size, then read status, headers, and body as JSON.
Pick zgrab2-http-simple for title, status, and length only. Prefer httpx when you want tech detection on a URL list.
source github.com/zmap/zgrab2
use cases
Where zgrab2-http fits
Grab HTTP banners at scale
Send a request to every host in a list and capture the status, headers, and body as JSON, building a structured inventory of what each web service returns.
Fingerprint services after a port scan
Feed open web ports from a scanner into zgrab2-http so each one gets a full grab, turning open ports into identified HTTP services.
Inspect the TLS handshake
Use the HTTPS and TLS options to record certificate data, cipher suites, and handshake details alongside the HTTP response in one pass.
Probe specific endpoints
Set the method, endpoint, and custom headers to request a particular path or API route across the whole host list instead of just the root.
reference
zgrab2-http inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| sct | BOOLEAN | --sct | Request Signed Certificate Timestamps during TLS Handshake |
| port | STRING | --port | Specify port to grab on (default: 80) |
| time | STRING | --time | Explicit request time to use, instead of clock. YYYYMMDDhhmmss format. |
| debug | BOOLEAN | --debug | Include debug fields in the output. |
| flush | BOOLEAN | --flush | Flush after each line of output. |
| method | STRING | --method | Set HTTP request method type (default: GET) |
| no-sni | BOOLEAN | --no-sni | Do not send domain name in TLS Handshake regardless of whether known |
Showing key inputs. zgrab2-http exposes 53 inputs in total.
Full flag reference (53 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| sct | BOOLEAN | --sct | Request Signed Certificate Timestamps during TLS Handshake |
| port | STRING | --port | Specify port to grab on (default: 80) |
| time | STRING | --time | Explicit request time to use, instead of clock. YYYYMMDDhhmmss format. |
| debug | BOOLEAN | --debug | Include debug fields in the output. |
| flush | BOOLEAN | --flush | Flush after each line of output. |
| input | STRING | · | Input target |
| method | STRING | --method | Set HTTP request method type (default: GET) |
| no-sni | BOOLEAN | --no-sni | Do not send domain name in TLS Handshake regardless of whether known |
| senders | STRING | --senders | Number of send goroutines to use (default: 1000) |
| timeout | STRING | --timeout | Set connection timeout (0 = no timeout) (default: 10s) |
| trigger | STRING | --trigger | Invoke only on targets with specified tag |
| endpoint | STRING | --endpoint | Send an HTTP request to an endpoint (default: /) |
| max-size | STRING | --max-size | Max kilobytes to read in response to an HTTP request (default: 256) |
| maxbytes | STRING | --maxbytes | Maximum byte read limit per scan (0 = defaults) |
| no-ecdhe | BOOLEAN | --no-ecdhe | Do not allow ECDHE handshakes |
| root-cas | FILE | --root-cas | Set of certificates to use when verifying server certificates |
| use-https | BOOLEAN | --use-https | Perform an HTTPS connection on the initial host |
| gomaxprocs | STRING | --gomaxprocs | Set GOMAXPROCS (default: 0) |
| heartbleed | BOOLEAN | --heartbleed | Check if server is vulnerable to Heartbleed |
| input-file | FILE | · | Input file |
| prometheus | STRING | --prometheus | Address to use for Prometheus server (e.g. localhost:8080). If empty, Prometheus is disabled |
| user-agent | STRING | --user-agent | Set a custom user agent (default: Mozilla/5.0 zgrab/0.x) |
| dsa-enabled | BOOLEAN | --dsa-enabled | Accept server DSA keys |
| max-version | STRING | --max-version | The maximum SSL/TLS version that is acceptable. 0 means use the highest supported value. |
| min-version | STRING | --min-version | The minimum SSL/TLS version that is acceptable. 0 means that SSLv3 is the minimum. |
| next-protos | FILE | --next-protos | A list of supported application-level protocols |
| retry-https | BOOLEAN | --retry-https | If the initial request fails, reconnect and try with HTTPS. |
| server-name | STRING | --server-name | Server name used for certificate verification and (optionally) SNI |
| certificates | FILE | --certificates | Set of certificates to present to the server |
| cipher-suite | STRING | --cipher-suite | A comma-delimited list of hex cipher suites to advertise. |
| client-hello | STRING | --client-hello | Set an explicit ClientHello (base64 encoded) |
| client-random | STRING | --client-random | Set an explicit Client Random (base64 encoded) |
| max-redirects | STRING | --max-redirects | Max number of redirects to follow (default: 0) |
| session-ticket | BOOLEAN | --session-ticket | Send support for TLS Session Tickets and output ticket if presented |
| with-body-size | BOOLEAN | --with-body-size | Enable the body_size attribute, for how many bytes actually read |
| certificate-map | FILE | --certificate-map | A file mapping server names to certificates |
| extended-random | BOOLEAN | --extended-random | Send TLS Extended Random Extension |
| keep-client-logs | BOOLEAN | --keep-client-logs | Include the client-side logs in the TLS handshake |
| curve-preferences | STRING | --curve-preferences | A list of elliptic curves used in an ECDHE handshake, in order of preference. |
| heartbeat-enabled | BOOLEAN | --heartbeat-enabled | If set, include the heartbeat extension |
| override-sig-hash | BOOLEAN | --override-sig-hash | Override the default SignatureAndHashes TLS option with more expansive default |
| redirects-succeed | BOOLEAN | --redirects-succeed | Redirects are always a success, even if max-redirects is exceeded |
| fail-http-to-https | BOOLEAN | --fail-http-to-https | Trigger retry-https logic on known HTTP/400 protocol mismatch responses |
| read-limit-per-host | STRING | --read-limit-per-host | Maximum total kilobytes to read for a single host (default 96kb) (default: 96) |
| connections-per-host | STRING | --connections-per-host | Number of times to connect to each host (results in more output) (default: 1) |
| custom-headers-names | FILE | --custom-headers-names | CSV of custom HTTP headers to send to server |
| signature-algorithms | STRING | --signature-algorithms | Signature and hash algorithms that are acceptable |
| custom-headers-values | FILE | --custom-headers-values | CSV of custom HTTP header values to send to server. Should match order of custom-headers-names |
| extended-master-secret | BOOLEAN | --extended-master-secret | Offer RFC 7627 Extended Master Secret extension |
| custom-headers-delimiter | STRING | --custom-headers-delimiter | Delimiter for customer header name/value CSVs |
| verify-server-certificate | BOOLEAN | --verify-server-certificate | ail if the server certificate does not match the server-name, or does not chain to a trusted root. |
| follow-localhost-redirects | BOOLEAN | --follow-localhost-redirects | Follow HTTP redirects to localhost |
| compute-decoded-body-hash-algorithm | STRING | --compute-decoded-body-hash-algorithm | Choose algorithm for BodyHash field (sha256 or sha1) |
example
Run zgrab2-http
# zgrab2-http: HTTP GET banner grab on port 443echo 198.51.100.10 | zgrab2 http --port 443 --method GET --senders 50{"ip":"198.51.100.10","data":{"http":{"status_code":200,"headers":{"server":"nginx"}}}}{"ip":"203.0.113.5","data":{"http":{"status_code":301,"headers":{"server":"cloudflare"}}}}{"ip":"192.0.2.8","data":{"http":{"status_code":200,"headers":{"server":"Apache"}}}}{"ip":"198.51.100.44","data":{"http":{"status_code":403,"headers":{"server":"nginx"}}}}guidance
Choosing zgrab2-http
Use after a port scan finds open web ports and you need full HTTP response JSON across the host list. Use zgrab2-http-simple for a compact summary. Use httpx for URL-list probing with tech detection.
zgrab2-http-simple
Same grab, parsed to title, status, and content length. Prefer it for triage summaries.
httpx
HTTP prober with tech detection and JSONL. Prefer it for URL-list recon.
zgrab2-tls
TLS handshake and certificate only. Prefer it when HTTP content is out of scope.
faq
zgrab2-http questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run zgrab2-http yourself
A CIDR range feeds zmap, which finds open web ports and passes them to zgrab2-http so each service's HTTP banner lands as a queryable output.
Facts on this page come from the live Trickest tool library.