Recon
Collect several protocol grabs per host in one pass
Multi-protocol zgrab2 grabs driven by one config file.
overview
What zgrab2-multiple does
zgrab2-multiple runs several zgrab2 protocol modules against the same hosts in one pass. You describe modules and options in --config-file once; each host is probed in sequence instead of launching separate HTTP, TLS, and other grabs.
Reach for it when a single-protocol node leaves gaps. --break-on-success stops later modules once one answers. --continue-on-error keeps the chain going after a failed module. --senders sets scan concurrency.
In a Trickest workflow the node reads a host list plus a config file and writes a file and a folder of JSON results. Prefer focused peers (zgrab2-http, zgrab2-tls, zgrab2-jarm) when only one protocol matters.
source github.com/zmap/zgrab2
use cases
Where zgrab2-multiple fits
Grab several protocols in one run
Define multiple zgrab2 modules in a config file so each host is probed for HTTP, TLS, and more in a single pass with one combined output.
Stop at the first protocol that answers
Enable break-on-success so later modules are skipped once one succeeds, which is handy when you only need to know what a host speaks first.
Survey mixed services together
Point one job at hosts running different services and collect a per-host record across every configured protocol instead of running separate scans.
Keep going past module errors
Use continue-on-error so a single failing protocol does not abort the chain, letting the remaining modules still produce results for each host.
reference
zgrab2-multiple inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input-file | FILE | · | Input file of hosts to scan. |
| config-file | FILE | --config-file | Config file listing each protocol module and its options. |
| break-on-success | BOOLEAN | --break-on-success | Skip later protocols once one succeeds (default false). |
| continue-on-error | BOOLEAN | --continue-on-error | Keep running later protocols after one errors (default true). |
| senders | STRING | --senders | Number of send goroutines, which sets scan concurrency (default 1000). |
| connections-per-host | STRING | --connections-per-host | Times to connect to each host for more output (default 1). |
| read-limit-per-host | STRING | --read-limit-per-host | Cap on kilobytes read per host (default 96). |
| debug | BOOLEAN | --debug | Include debug fields in each result. |
Showing key inputs. zgrab2-multiple exposes 12 inputs in total.
Full flag reference (12 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| debug | BOOLEAN | --debug | Include debug fields in the output. |
| flush | BOOLEAN | --flush | Flush after each line of output. |
| input | STRING | · | Input target to scan, passed inline. |
| senders | STRING | --senders | Number of send goroutines to use (default 1000). |
| gomaxprocs | STRING | --gomaxprocs | Set GOMAXPROCS (default 0). |
| input-file | FILE | · | Input file of hosts to scan. |
| prometheus | STRING | --prometheus | Address for the Prometheus server (e.g. localhost:8080). If empty, Prometheus is disabled. |
| config-file | FILE | --config-file | Config file listing each protocol module and its options. |
| break-on-success | BOOLEAN | --break-on-success | If a protocol succeeds, do not run following protocols (default false). |
| continue-on-error | BOOLEAN | --continue-on-error | If a protocol errors, do not run following protocols (default true). |
| read-limit-per-host | STRING | --read-limit-per-host | Maximum total kilobytes to read for a single host (default 96). |
| connections-per-host | STRING | --connections-per-host | Number of times to connect to each host, which produces more output (default 1). |
example
Run zgrab2-multiple
# grab HTTP and TLS on each host, keep going past module errorszgrab2 multiple --config-file multiple.ini --input-file targets.txt --senders 500 --continue-on-error --output-file results.json{"domain":"web-01.example.com","ip":"198.51.100.10","data":{"http":{"status":"success","protocol":"http","result":{"response":{"status_code":200,"headers":{"server":["nginx/1.24.0"]}}}},"tls":{"status":"success","protocol":"tls","result":{"handshake_log":{"server_certificates":{"certificate":{"parsed":{"subject":{"common_name":["example.com"]}}}}}}}}}{"domain":"api.example.com","ip":"198.51.100.11","data":{"http":{"status":"success","protocol":"http","result":{"response":{"status_code":301,"headers":{"location":["https://api.example.com/"]}}}},"tls":{"status":"success","protocol":"tls","result":{"handshake_log":{"server_hello":{"version":{"name":"TLSv1.3"}}}}}}}{"domain":"mail.example.com","ip":"198.51.100.12","data":{"http":{"status":"connection-refused","protocol":"http","error":"dial tcp 198.51.100.12:80: connect: connection refused"},"tls":{"status":"success","protocol":"tls","result":{"handshake_log":{"server_hello":{"cipher_suite":{"name":"TLS_AES_128_GCM_SHA256"}}}}}}}{"domain":"vpn.example.com","ip":"203.0.113.24","data":{"http":{"status":"success","protocol":"http","result":{"response":{"status_code":403,"headers":{"server":["Apache/2.4.58"]}}}},"tls":{"status":"success","protocol":"tls","result":{"handshake_log":{"server_certificates":{"certificate":{"parsed":{"issuer":{"common_name":["R11"]}}}}}}}}}{"domain":"staging.example.com","ip":"203.0.113.25","data":{"http":{"status":"success","protocol":"http","result":{"response":{"status_code":200,"headers":{"server":["gunicorn"]}}}},"tls":{"status":"io-timeout","protocol":"tls","error":"read tcp 203.0.113.25:443: i/o timeout"}}}{"domain":"cache.example.com","ip":"203.0.113.26","data":{"http":{"status":"success","protocol":"http","result":{"response":{"status_code":200,"headers":{"server":["Varnish"]}}}},"tls":{"status":"success","protocol":"tls","result":{"handshake_log":{"server_hello":{"version":{"name":"TLSv1.2"}}}}}}}guidance
Choosing zgrab2-multiple
Use zgrab2-multiple when one host list needs several protocol grabs in a single pass. For one protocol, use zgrab2-http, zgrab2-tls, or zgrab2-jarm.
zgrab2-http
HTTP only. Simpler when you need one protocol, not a configured set.
zgrab2-tls
TLS handshake only. Use when certificates and version negotiation are the sole goal.
fingerprintx
Identifies services behind open ports across many protocols. Lighter when you need names, not full grabs.
faq
zgrab2-multiple questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run zgrab2-multiple yourself
A host list and a config feed zgrab2-multiple, which runs every configured protocol per host and writes the combined results as a queryable output.
Facts on this page come from the live Trickest tool library.