新发布Aug 3, 2026
httpgrep v4.7
异步 HTTP(S) 扫描器，可在主机、端口、CIDR/网段及 TLS 证书虚拟主机之间，对响应正文（body）与响应头（headers）执行字符串或正则表达式的 grep 搜索。
描述
一个快速、异步的 Python 工具，可扫描 HTTP(S) 服务器，并在 HTTP 响应体 和响应头中 grep 字符串或正则表达式模式。
它接受单个主机、URL、CIDR 范围、IP 范围或文件；可对每个目标扫描多个 端口（单个端口、逗号分隔列表或范围，并逐端口自动检测 TLS 与明文）； 可直接从 TLS 证书中提取并扫描基于名称的 (v)host；将匹配结果实时 流式输出到终端；并可将结果写入文本、CSV 或 JSONL 日志文件。
它专为大规模扫描而构建：异步核心驱动数千个并发连接，TCP 预检可低成本 跳过无响应的端口，每主机与全局超时确保其不会在缓慢/失效目标上挂起， 并且被中断的扫描可以恢复。
环境要求
- 位于 POSIX 系统上的 Python 3.11+（Linux、*BSD、macOS —— 使用
termios和 asyncio 的 Unix 信号处理） - httpx -
pip install -r requirements.txt（或pip install httpx） - 可选，若存在则自动使用：
uvloop（更快的事件循环）、aiodns（为-r提供非阻塞 DNS）、h2（为-2提供 HTTP/2）、httpx[socks]/ socksio （SOCKS 代理）
httpgrep 是一个独立的单文件脚本 —— 直接运行 ./httpgrep.py 即可。
用法
$ httpgrep -H
__ __ __
/ /_ / /_/ /_____ ____ _________ ____
/ __ \/ __/ __/ __ \/ __ `/ ___/ _ \/ __ \
/ / / / /_/ /_/ /_/ / /_/ / / / __/ /_/ /
/_/ /_/\__/\__/ .___/\__, /_/ \___/ .___/
/_/ /____/ /_/
--== [ by nullsecurity.net ] ==--
usage
httpgrep -h <arg> -s <arg> [opts] | <misc>
target options
-h <hosts|file> - single host/url or host-/cidr-range or file containing
hosts or file containing URLs, e.g.: foobar.net,
192.168.0.1-192.168.0.254, 192.168.0.0/24, /tmp/hosts.txt
a comma-separated list of hosts also works, e.g.:
1.2.3.4,foo.net,10.0.0.0/24
NOTE: hosts can also contain ':<ports>' on cmdline or in
file, where <ports> is a single port, comma-list or
range, e.g.: foo.net:8080, foo.net:80,443, 10.0.0.1:1-1024
-p <ports|file> - port(s) to connect to: single port, comma-separated list,
range, or a file with one spec per line, e.g.: 80,
80,443,8080, 8000-8100, /tmp/ports.txt
(default: 80, or 443 when -t is given)
-t - force TLS/SSL on all ports. by default the scheme is
auto-detected per port (plain http, switching to TLS if
the port speaks it)
-u <URI|file> - URI or comma-separated URIs or file with URIs (one per
line) to search given strings in, e.g.: /foobar/,
/foo.html, /admin,/login, /tmp/paths.txt (default: /)
-r - show the reverse-dns (PTR) name of scanned IPv4s as a
label; the ip stays the scan target (no scope drift).
non-blocking with the aiodns package
http options
-X <method> - HTTP request method to use, any case (default: get).
use '?' to list available methods.
-a <user:pass> - http auth credentials (format: 'user:pass')
-U <UA> - set custom User-Agent (default: latest ms edge, windows)
-A - use random user-agent per request
-R <headers> - set custom headers (format: 'foo=bar;lol=lulz;...')
-C <cookies> - set cookies (format: 'foo=bar;lol=lulz;...')
-F - don't follow HTTP redirects
-L <num> - max redirects to follow (default: 10; ignored with -F)
-E - verify TLS/SSL certificates (default: no verification)
-P <proxy> - use proxy (format: '[http|https|socks4|socks5]://host:port')
(socks needs the 'httpx[socks]' / socksio package)
-f <codes> - only report responses with given HTTP status codes,
e.g.: '200', '200,301,302'
-e <codes> - exclude responses with given HTTP status codes,
e.g.: '404', '403,404,500'
-2 - try HTTP/2 (ALPN-negotiated on TLS, falls back to 1.1;
plain http stays 1.1). needs the 'h2' package
search options
-s <str|file> - a single string/regex or multiple strings/regex in a file
to find in HTTP response bodies and headers (see -w),
e.g.: 'tomcat 8', '/tmp/igot0daysforthese.txt'
-S <str|file> - invert (grep -v): drop ALL matches of a response if this
string/regex (or file) appears anywhere in its body or
headers, e.g. to filter out dynamic error / 404 pages
-w <where> - where to search: headers, body, or headers,body
(default: headers,body)
-b <bytes> - num bytes of context to show from a body match
(default: 64)
-m <size> - max body to read + search; suffix b/kb/mb, no suffix = kb,
e.g.: 512, 1mb, 262144b (default: 256kb)
-i - use case-insensitive search
-I - use case-insensitive invert (for -S)
scan options
-x <num> - max concurrent connections (async; default: 300). raise
ulimit -n accordingly for very high values
-c <seconds> - per-host read timeout in seconds, also caps body read
time. the tcp preflight is capped at 2s regardless, so
filtered/dead hosts free their slot fast (default: 3.0)
-G <seconds> - global timeout: hard-stop the whole scan after N seconds
(safety net against any hang; default: none)
-y <num> - retry a failed probe up to <num> times (default: 0).
helps with flaky hosts at scale; keep it small
-1 - once a host has a match, skip its not-yet-started probes
(best-effort; in-flight requests still finish, so under
high -x you may still see a few matches per host)
-z <size> - scan targets in random order within a memory-bounded
window of <size> ram (suffix b/kb/mb/gb), e.g.: -z 1gb.
keeps huge ranges/files from exhausting memory
-Z <num> - cap the -z window at <num> targets (default 2000000,
~267mb at ~140 bytes each). more = wider mixing on huge
ranges, at the cost of ram and start-up buffering
-W - save/resume: on ctrl+c write progress to httpgrep.session;
rerun with -W to resume from it (else start fresh)
-T <0|1> - also probe the cert (v)hosts (CN + SAN) as extra requests
on top of the direct scan. 0 = via Host header on the
same ip (in-scope); 1 = ALSO by dns name/SNI (may leave
scope). needs TLS (https url, -t, or a *443 port).
output options
-l <file> - log found matches to <file>.<fmt> per chosen -O format
(e.g. -l out -O csv,jsonl => out.csv, out.jsonl)
-O <formats> - log file format(s), comma-list of: txt, csv, jsonl
(default: txt; use '?' to list). terminal output always
stays human-readable.
-v - verbose: print each url as it gets scanned
-7 - escape non-ASCII in terminal output to \xNN, so a hostile
response body can't corrupt your terminal (logs stay raw)
misc options
-H - print help
-V - print version information
examples
# grep for 'apache' in headers and body of a single host
$ httpgrep -h foobar.net -s apache
# scan a CIDR range on port 8080, search for 'tomcat' in body only
$ httpgrep -h 192.168.0.0/24 -p 8080 -s tomcat -w body
# scan a host across multiple ports and a port range for 'jenkins'
$ httpgrep -h 192.168.0.10 -p 80,443,8080,8000-8100 -s jenkins -i
# scan host list, search string file, log matches (-> /tmp/out.txt)
$ httpgrep -h /tmp/hosts.txt -s /tmp/strings.txt -x 200 -l /tmp/out
# grep for 'admin' case-insensitively across multiple URIs via TLS
$ httpgrep -h foobar.net -t -u /admin,/login,/dashboard -s admin -i
# scan IP range, reverse DNS, only report 200 responses
$ httpgrep -h 10.0.0.1-10.0.0.254 -s 'powered by' -r -f 200
# search headers only, don't follow redirects, verbose output
$ httpgrep -h foobar.net -s 'X-Powered-By' -w headers -F -v
# grep for 'admin', but drop dynamic error pages (invert, case-insensitive)
$ httpgrep -h 192.168.0.0/24 -s admin -i -S 'error|not found' -I
# route through proxy, custom UA, search for version strings
$ httpgrep -h /tmp/hosts.txt -s 'nginx/1\.' -P http://127.0.0.1:8080 -U 'curl/8.0'
# big resumable scan: ctrl+c saves state, rerun with -W to continue; also
# cap the whole run at 1 hour as a hang safety net
$ httpgrep -h 10.0.0.0/16 -p 80,443 -s admin -W -G 3600
输出
匹配结果实时打印，每行一条：
[*] <url> | [vhost] | <status> | <type> | <match>
<url>- 被扫描的 URL（scheme://host:port/uri）。<vhost>- 在使用-T（通过Host头尝试的证书 (v)host）或-r（被扫描 IP 的 PTR 名称）时出现；直接扫描时为空。<status>- HTTP 响应状态码（重定向之后）。<type>-body或header。<match>- body 命中：匹配位置附近一段简短的 repr 窗口（-b字节）； header 命中：name: value。
终端始终显示这种人类可读的形式。使用 -l <base> 时，相同的匹配结果
会按每种 -O 格式同步写入 <base>.<fmt> —— txt（这些行）、csv
（带表头的 url,vhost,status,type,match 行）、jsonl（每个匹配
一条 JSON 对象）。
在多目标扫描中，会显示一条实时状态行（在 tty 上固定于底部， 重定向时为普通行）：
[+] wait bitch, scanning: <targets> | <scanned>/<total> | <pct>% | <n> hits
<total> 是目标数量（CIDR/范围按计算得出，不展开）；<n> hits
是到目前为止已输出的匹配行累计数。
作者
noptrix
备注
- 快速而粗糙的代码（quick'n'dirty）
- httpgrep 已打包并可用于 BlackArch Linux
- 我的 master 分支始终稳定；dev 分支用于当前开发工作。
- 你找到的所有公开发布内容均通过 nullsecurity.net 正式公告并发布。
许可证
请参阅 docs/LICENSE。
免责声明
我们在此强调，nullsecurity.net 上发现的与黑客相关的材料仅用于教育目的。我们对任何损害概不负责。您应对自己的行为负责。