Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
undetected-httpx — Stop getting 403 Forbidden. A specialized httpx-like toolkit for WAF evasion. | Kitploit
Tools/GitHubGitHub/michele0303/undetected-httpx
ReconnaissanceWeb Proxies & InterceptionIDS/IPS EvasionInformation GatheringWAF BypassWeb SecurityAnti-BotFingerprint Spoofing
GitHubmichele0303/undetected-httpx

undetected-httpx

Stop getting 403 Forbidden. A specialized httpx-like toolkit for WAF evasion.

View Repository
211434 days agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

undetected-httpx 2.0

Go 1.26 or newer HTTPCloak browser transport MIT License

undetected-httpx is an HTTP probing toolkit built on ProjectDiscovery's httpx, with browser TLS and HTTP/2 fingerprints powered by HTTPCloak.

Version 2.0 replaces the Python wrapper with a Go fork of httpx v1.12.0. You get the upstream probes, flags and output formats, with HTTPCloak v1.7.3 handling the main HTTP transport. The default browser profile is chrome-latest.

📦 Installation

Install with Go 1.26.0+:

go install github.com/Michele0303/undetected-httpx/v2/cmd/undetected-httpx@latest

Use @v2.0.0 instead of @latest to pin the release. Add your Go binary directory to PATH: $GOBIN, or $(go env GOPATH)/bin when GOBIN is unset.

Prebuilt Linux and macOS binaries are available in the releases.

Build from a source checkout 
git clone --branch v2.0.0 https://github.com/Michele0303/undetected-httpx.git
cd undetected-httpx
make build
./bin/undetected-httpx -h

Run make install to install the command in your Go binary directory.

The previous Python package remains in legacy/python; see the migration guide when upgrading.

🎭 Real-world Comparison

On the same five selected URLs, with the same User-Agent, httpx returned 403 Forbidden while undetected-httpx returned 200 OK.

undetected-httpx 2.0

undetected-httpx returning HTTP 200 on five selected URLs 		httpx v1.12.0 (Original)

httpx returning HTTP 403 on the same five URLs

Real tool executions, recorded with VHS on 16 October 2026. Results vary by site; a 200 response can still contain a challenge page.

Watch the MP4

📊 Technical Capabilities

Featureundetected-httpx 2.0httpx v1.12.0
Network stackHTTPCloakGo net/http
Default TLS fingerprintBrowser profile (chrome-latest)Upstream default
Selected demo results✅ 5 × HTTP 2005 × HTTP 403
Probes & outputhttpx probes, text and JSONLhttpx probes, text and JSONL

🛠 Key Features

  • Browser transport: browser TLS, HTTP/2 settings and headers through HTTPCloak, with HTTP/1.1 fallback.
  • Familiar CLI: keep the httpx probing pipeline, retries and output formats; select a profile with --browser or -impersonate.
  • Native mode: use --native-http for custom resolvers, IP/network controls, TLS certificate probes and raw requests.

Browser impersonation does not guarantee access or solve JavaScript challenges. This adapter supports HTTP/1.1 and HTTP/2; see the compatibility table for supported options.

🚀 Usage

# Probe targets and show status codes and titles.
undetected-httpx -l targets.txt -sc -title

# Choose a browser profile and write JSONL.
undetected-httpx -u https://example.com --browser chrome-latest -json

# Use the native transport for TLS and IP probes.
undetected-httpx -u https://example.com --native-http -tls-grab -ip

Run make test for local regressions. Upstream & licenses

Download Tool