Menu
ProjectDiscovery httpx probing syntax, exact probe flags, and automation-safe output patterns.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Authorized AI penetration testing assistant for web applications, APIs, and infrastructure. Performs reconnaissance, vulnerability assessment, PoC validation, exploit chaining, and professional reporting. Use when the user asks for pentest, penetration test, security assessment, vulnerability scan, bug bounty research, authorized hacking, SQLi/XSS/IDOR/SSRF testing, API security audit, or exploit validation.
Authorized AI penetration testing for web apps, APIs, cloud, and infrastructure. Full kill-chain methodology with PoC validation, vulnerability chaining, and professional reporting. Triggers on: pentest, penetration test, security assessment, vuln scan, bug bounty, red team, authorized hack, SQL injection test, XSS test, IDOR, SSRF, API security, exploit validation, security audit.
Authorized AI penetration testing assistant — full-spectrum security testing with deep exploitation skills and integrated tooling. Use for web app pentests, API security, vuln validation, PoC development, bug bounty, and security assessments. Triggers on pentest, penetration test, security audit, exploit, SQLi, XSS, IDOR, SSRF.
API安全测试的专业技能和方法论
JWT and OIDC security testing covering token forgery, algorithm confusion, and claim manipulation
AWS cloud security testing covering IAM misconfigurations, S3 exposure, metadata abuse, and privilege escalation paths
| name | httpx-tooling |
| description | ProjectDiscovery httpx probing syntax, exact probe flags, and automation-safe output patterns. |
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Official docs:
Canonical syntax:
httpx [flags]
High-signal flags:
-u, -target <url> single target-l, -list <file> target list-nf, -no-fallback probe both HTTP and HTTPS-nfs, -no-fallback-scheme do not auto-switch schemes-sc status code-title page title-server, -web-server server header-td, -tech-detect technology detection-fr, -follow-redirects follow redirects-mc <codes> / -fc <codes> match or filter status codes-path <path_or_file> probe specific paths-p, -ports <ports> probe custom ports-proxy, -http-proxy <url> proxy target requests-tlsi, -tls-impersonate experimental TLS impersonation-j, -json JSONL output-sr, -store-response store request/response artifacts-srd, -store-response-dir <dir> custom directory for stored artifacts-silent compact output-rl <n> requests/second cap-t <n> threads-timeout <seconds> request timeout-retries <n> retry attempts-o <file> output fileAgent-safe baseline for automation:
httpx -l hosts.txt -sc -title -server -td -fr -timeout 10 -retries 1 -rl 50 -t 25 -silent -j -o httpx.jsonl
Common patterns:
httpx -l hosts.txt -sc -title -server -td -silent -o httpx.txthttpx -l hosts.txt -path /,/login,/admin -sc -title -silent -j -o httpx_paths.jsonlhttpx -l hosts.txt -nf -sc -title -silenthttpx -l hosts.txt -vhost -sc -title -silent -j -o httpx_vhost.jsonlhttpx -l hosts.txt -sc -title -proxy http://127.0.0.1:48080 -silent -j -o httpx_proxy.jsonlhttpx -l hosts.txt -fr -sr -srd recon/httpx_store -sc -title -server -cl -ct -location -probe -silentCritical correctness rules:
-j -o <file>.-rl and -t explicit for reproducible throughput.-nf when you need dual-scheme probing from host-only input.-path or -ports, keep scope tight to avoid accidental scan inflation.-sr -srd <dir> when later steps need raw response artifacts (JS/route extraction, grepping, replay).Usage rules:
-silent for pipeline-friendly output.-mc/-fc when downstream steps depend on specific response classes.-proxy flag over global proxy env vars when only httpx traffic should be proxied.-h/--help for routine runs unless absolutely necessary.Failure recovery:
-rl/-t and/or increase -timeout.-fc filters or -fd duplicate filtering.-nf (and avoid -nfs).If uncertain, query web_search with:
site:docs.projectdiscovery.io httpx <flag> usage
Companion: wafw00f <url> fingerprints the WAF/CDN in front of a target
(Cloudflare, Akamai, AWS WAF, etc.). Run it once after httpx confirms the
host is live — the WAF identity decides whether to throttle fuzzing,
swap to evasion payload sets, or assume blocking and route differently.
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Official docs:
Canonical syntax:
httpx [flags]
High-signal flags:
-u, -target <url> single target-l, -list <file> target list-nf, -no-fallback probe both HTTP and HTTPS-nfs, -no-fallback-scheme do not auto-switch schemes-sc status code-title page title-server, -web-server server header-td, -tech-detect technology detection-fr, -follow-redirects follow redirects-mc <codes> / -fc <codes> match or filter status codes-path <path_or_file> probe specific paths-p, -ports <ports> probe custom ports-proxy, -http-proxy <url> proxy target requests-tlsi, -tls-impersonate experimental TLS impersonation-j, -json JSONL output-sr, -store-response store request/response artifacts-srd, -store-response-dir <dir> custom directory for stored artifacts-silent compact output-rl <n> requests/second cap-t <n> threads-timeout <seconds> request timeout-retries <n> retry attempts-o <file> output fileAgent-safe baseline for automation:
httpx -l hosts.txt -sc -title -server -td -fr -timeout 10 -retries 1 -rl 50 -t 25 -silent -j -o httpx.jsonl
Common patterns:
httpx -l hosts.txt -sc -title -server -td -silent -o httpx.txthttpx -l hosts.txt -path /,/login,/admin -sc -title -silent -j -o httpx_paths.jsonlhttpx -l hosts.txt -nf -sc -title -silenthttpx -l hosts.txt -vhost -sc -title -silent -j -o httpx_vhost.jsonlhttpx -l hosts.txt -sc -title -proxy http://127.0.0.1:48080 -silent -j -o httpx_proxy.jsonlhttpx -l hosts.txt -fr -sr -srd recon/httpx_store -sc -title -server -cl -ct -location -probe -silentCritical correctness rules:
-j -o <file>.-rl and -t explicit for reproducible throughput.-nf when you need dual-scheme probing from host-only input.-path or -ports, keep scope tight to avoid accidental scan inflation.-sr -srd <dir> when later steps need raw response artifacts (JS/route extraction, grepping, replay).Usage rules:
-silent for pipeline-friendly output.-mc/-fc when downstream steps depend on specific response classes.-proxy flag over global proxy env vars when only httpx traffic should be proxied.-h/--help for routine runs unless absolutely necessary.Failure recovery:
-rl/-t and/or increase -timeout.-fc filters or -fd duplicate filtering.-nf (and avoid -nfs).If uncertain, query web_search with:
site:docs.projectdiscovery.io httpx <flag> usage
Companion: wafw00f <url> fingerprints the WAF/CDN in front of a target
(Cloudflare, Akamai, AWS WAF, etc.). Run it once after httpx confirms the
host is live — the WAF identity decides whether to throttle fuzzing,
swap to evasion payload sets, or assume blocking and route differently.
record_vulnerability when running inside the penkit51 platformrecord_vulnerability when running inside the penkit51 platform