loading
Loading content
loading
Recon
Multi-protocol zgrab2 grabs driven by one config file.
overview
zgrab2-multiple runs several zgrab2 protocol modules against the same hosts in one pass. You describe modules and options in --config-file once; each host is probed in sequence instead of launching separate HTTP, TLS, and other grabs.
Reach for it when a single-protocol node leaves gaps. --break-on-success stops later modules once one answers. --continue-on-error keeps the chain going after a failed module. --senders sets scan concurrency.
In a Trickest workflow the node reads a host list plus a config file and writes a file and a folder of JSON results. Prefer focused peers (zgrab2-http, zgrab2-tls, zgrab2-jarm) when only one protocol matters.
source github.com/zmap/zgrab2
use cases
Define multiple zgrab2 modules in a config file so each host is probed for HTTP, TLS, and more in a single pass with one combined output.
Enable break-on-success so later modules are skipped once one succeeds, which is handy when you only need to know what a host speaks first.
Point one job at hosts running different services and collect a per-host record across every configured protocol instead of running separate scans.
Use continue-on-error so a single failing protocol does not abort the chain, letting the remaining modules still produce results for each host.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input-file | FILE | · | Input file of hosts to scan. |
| config-file | FILE | --config-file | Config file listing each protocol module and its options. |
| break-on-success | BOOLEAN | --break-on-success | Skip later protocols once one succeeds (default false). |
| continue-on-error | BOOLEAN | --continue-on-error | Keep running later protocols after one errors (default true). |
| senders | STRING | --senders | Number of send goroutines, which sets scan concurrency (default 1000). |
| connections-per-host | STRING | --connections-per-host | Times to connect to each host for more output (default 1). |
| read-limit-per-host | STRING | --read-limit-per-host | Cap on kilobytes read per host (default 96). |
| debug | BOOLEAN | --debug | Include debug fields in each result. |
Showing key inputs. zgrab2-multiple exposes 12 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| debug | BOOLEAN | --debug | Include debug fields in the output. |
| flush | BOOLEAN | --flush | Flush after each line of output. |
| input | STRING | · | Input target to scan, passed inline. |
| senders | STRING | --senders | Number of send goroutines to use (default 1000). |
| gomaxprocs | STRING | --gomaxprocs | Set GOMAXPROCS (default 0). |
| input-file | FILE | · | Input file of hosts to scan. |
| prometheus | STRING | --prometheus | Address for the Prometheus server (e.g. localhost:8080). If empty, Prometheus is disabled. |
| config-file | FILE | --config-file | Config file listing each protocol module and its options. |
| break-on-success | BOOLEAN | --break-on-success | If a protocol succeeds, do not run following protocols (default false). |
| continue-on-error | BOOLEAN | --continue-on-error | If a protocol errors, do not run following protocols (default true). |
| read-limit-per-host | STRING | --read-limit-per-host | Maximum total kilobytes to read for a single host (default 96). |
| connections-per-host | STRING | --connections-per-host | Number of times to connect to each host, which produces more output (default 1). |
example
# grab HTTP and TLS on each host, keep going past module errorszgrab2 multiple --config-file multiple.ini --input-file targets.txt --senders 500 --continue-on-error --output-file results.json{"domain":"web-01.example.com","ip":"198.51.100.10","data":{"http":{"status":"success","protocol":"http","result":{"response":{"status_code":200,"headers":{"server":["nginx/1.24.0"]}}}},"tls":{"status":"success","protocol":"tls","result":{"handshake_log":{"server_certificates":{"certificate":{"parsed":{"subject":{"common_name":["example.com"]}}}}}}}}}{"domain":"api.example.com","ip":"198.51.100.11","data":{"http":{"status":"success","protocol":"http","result":{"response":{"status_code":301,"headers":{"location":["https://api.example.com/"]}}}},"tls":{"status":"success","protocol":"tls","result":{"handshake_log":{"server_hello":{"version":{"name":"TLSv1.3"}}}}}}}{"domain":"mail.example.com","ip":"198.51.100.12","data":{"http":{"status":"connection-refused","protocol":"http","error":"dial tcp 198.51.100.12:80: connect: connection refused"},"tls":{"status":"success","protocol":"tls","result":{"handshake_log":{"server_hello":{"cipher_suite":{"name":"TLS_AES_128_GCM_SHA256"}}}}}}}{"domain":"vpn.example.com","ip":"203.0.113.24","data":{"http":{"status":"success","protocol":"http","result":{"response":{"status_code":403,"headers":{"server":["Apache/2.4.58"]}}}},"tls":{"status":"success","protocol":"tls","result":{"handshake_log":{"server_certificates":{"certificate":{"parsed":{"issuer":{"common_name":["R11"]}}}}}}}}}{"domain":"staging.example.com","ip":"203.0.113.25","data":{"http":{"status":"success","protocol":"http","result":{"response":{"status_code":200,"headers":{"server":["gunicorn"]}}}},"tls":{"status":"io-timeout","protocol":"tls","error":"read tcp 203.0.113.25:443: i/o timeout"}}}{"domain":"cache.example.com","ip":"203.0.113.26","data":{"http":{"status":"success","protocol":"http","result":{"response":{"status_code":200,"headers":{"server":["Varnish"]}}}},"tls":{"status":"success","protocol":"tls","result":{"handshake_log":{"server_hello":{"version":{"name":"TLSv1.2"}}}}}}}guidance
Use zgrab2-multiple when one host list needs several protocol grabs in a single pass. For one protocol, use zgrab2-http, zgrab2-tls, or zgrab2-jarm.
HTTP only. Simpler when you need one protocol, not a configured set.
TLS handshake only. Use when certificates and version negotiation are the sole goal.
Identifies services behind open ports across many protocols. Lighter when you need names, not full grabs.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A host list and a config feed zgrab2-multiple, which runs every configured protocol per host and writes the combined results as a queryable output.
Facts on this page come from the live Trickest tool library.