httprobe

Overview

httprobe reads a list of domains from stdin and checks each one for HTTP and HTTPS services. It’s designed as a pipeline component — the final filter that converts a list of discovered subdomains into a list of live web hosts. Fast, simple, and designed to work with Unix pipes.

Installation

go install github.com/tomnomnom/httprobe@latest

Basic Usage

Check which subdomains have live web servers

cat subdomains.txt | httprobe

# Output: only URLs that respond to HTTP/HTTPS
# https://api.example.com
# http://dev.example.com
# https://mail.example.com

With concurrency

cat subdomains.txt | httprobe -c 50

With timeout

cat subdomains.txt | httprobe -t 3000  # 3 seconds

Protocol Options

# Check specific protocols only
cat subdomains.txt | httprobe -p http:80
cat subdomains.txt | httprobe -p https:443

Check additional ports

cat subdomains.txt | httprobe -p https:8443 -p http:8080

Skip HTTP (only HTTPS)

cat subdomains.txt | httprobe --prefer-https

Probe common additional ports

cat subdomains.txt | httprobe \
  -p http:80 -p https:443 \
  -p http:8080 -p https:8443 \
  -p http:8000 -p http:3000

Pipeline Integration

Full subdomain → web host pipeline

subfinder -d example.com -silent | httprobe > live_web.txt

With assetfinder

assetfinder --subs-only example.com | httprobe

# Multi-tool aggregation
{
  subfinder -d target.com -silent
  assetfinder --subs-only target.com
  amass enum -passive -d target.com -o /dev/stdout
} | sort -u | httprobe -c 40 | tee live_hosts.txt

Then screenshot live hosts

cat live_hosts.txt | gowitness file -

Then scan with nuclei

cat live_hosts.txt | nuclei -t technologies/

Output Processing

Extract just hostnames (no protocol)

cat subdomains.txt | httprobe | sed 's|https\?://||'

Count live hosts

cat subdomains.txt | httprobe | wc -l

# Save separately by protocol
cat subdomains.txt | httprobe | grep "^https" > https_only.txt
cat subdomains.txt | httprobe | grep "^http://" > http_only.txt

Pipe into feroxbuster for directory brute-force

cat live_hosts.txt | xargs -I{} feroxbuster -u {} -w wordlist.txt

Tips

• httprobe is a pipeline tool — always read from stdin, output to stdout
• Increase concurrency (-c 50 or higher) for large subdomain lists
• Use with prefer-https when you only care about HTTPS endpoints
• httpx (from ProjectDiscovery) is a more feature-rich alternative with status codes and titles

httprobe [options]

(reads domains from stdin)

-c N           Concurrency (default: 20)
-t N           Timeout in milliseconds (default: 10000)
-p PROTO:PORT  Additional protocol:port to probe
               (repeatable; e.g., -p https:8443)
--prefer-https Skip HTTP checks when HTTPS works
-s             Skip default probes (http:80, https:443)

Vue d’ensemble

httprobe lit une liste de domaines depuis stdin et vérifie pour chacun la présence de services HTTP et HTTPS. Il est conçu comme un composant de pipeline : le filtre final qui convertit une liste de sous-domaines découverts en une liste d’hôtes web actifs. Rapide, simple, et pensé pour fonctionner avec les pipes Unix.

Installation

go install github.com/tomnomnom/httprobe@latest

Utilisation de base

# Vérifier quels sous-domaines ont un serveur web actif
cat subdomains.txt | httprobe

# Sortie : uniquement les URLs qui répondent en HTTP/HTTPS
# https://api.example.com
# http://dev.example.com
# https://mail.example.com

# Avec de la concurrence
cat subdomains.txt | httprobe -c 50

# Avec un timeout
cat subdomains.txt | httprobe -t 3000  # 3 secondes

Options de protocole

# Vérifier uniquement des protocoles spécifiques
cat subdomains.txt | httprobe -p http:80
cat subdomains.txt | httprobe -p https:443

# Vérifier des ports supplémentaires
cat subdomains.txt | httprobe -p https:8443 -p http:8080

# Ignorer HTTP (uniquement HTTPS)
cat subdomains.txt | httprobe --prefer-https

# Sonder des ports supplémentaires courants
cat subdomains.txt | httprobe \
  -p http:80 -p https:443 \
  -p http:8080 -p https:8443 \
  -p http:8000 -p http:3000

Intégration en pipeline

# Pipeline complet sous-domaines -> hôtes web
subfinder -d example.com -silent | httprobe > live_web.txt

# Avec assetfinder
assetfinder --subs-only example.com | httprobe

# Agrégation multi-outils
{
  subfinder -d target.com -silent
  assetfinder --subs-only target.com
  amass enum -passive -d target.com -o /dev/stdout
} | sort -u | httprobe -c 40 | tee live_hosts.txt

# Puis capture d'écran des hôtes actifs
cat live_hosts.txt | gowitness file -

# Puis scan avec nuclei
cat live_hosts.txt | nuclei -t technologies/

Traitement de la sortie

# Extraire uniquement les noms d'hôte (sans protocole)
cat subdomains.txt | httprobe | sed 's|https\?://||'

# Compter les hôtes actifs
cat subdomains.txt | httprobe | wc -l

# Sauvegarder séparément par protocole
cat subdomains.txt | httprobe | grep "^https" > https_only.txt
cat subdomains.txt | httprobe | grep "^http://" > http_only.txt

# Passer dans feroxbuster pour du brute-force de répertoires
cat live_hosts.txt | xargs -I{} feroxbuster -u {} -w wordlist.txt

Conseils

• httprobe est un outil de pipeline : toujours lire depuis stdin, écrire vers stdout
• Augmenter la concurrence (-c 50 ou plus) pour les grandes listes de sous-domaines
• Utiliser prefer-https si seuls les endpoints HTTPS vous intéressent
• httpx (de ProjectDiscovery) est une alternative plus riche en fonctionnalités avec codes de statut et titres

httprobe [options]

(reads domains from stdin)

-c N           Concurrency (default: 20)
-t N           Timeout in milliseconds (default: 10000)
-p PROTO:PORT  Additional protocol:port to probe
               (repeatable; e.g., -p https:8443)
--prefer-https Skip HTTP checks when HTTPS works
-s             Skip default probes (http:80, https:443)