Overview

SentinelX HTTP — concurrent web status checker buatan WildanDev. Dilengkapi WAF detection, tech fingerprinting, TLS inspection, favicon hashing (Shodan pivot), hash response body, dan dukungan proxy HTTP/SOCKS5.

sxhttp adalah bagian dari ekosistem SentinelX — dibangun, diuji, dan dipakai sendiri dalam kegiatan security research sehari-hari WildanDev.

Install

$ go install github.com/SentinelXofficial/sxhttp@latest

Fitur Utama

WAF detection & tech fingerprinting
TLS inspection (version, cipher, CN, expiry, SANs)
Favicon mmh3 hash — Shodan pivot
Body hash: MD5, SHA256, MurmurHash3
Filter by status code, string, regex
Proxy support: HTTP & SOCKS5
Self-update mechanism
JSON / CSV / txt output

Usage

Contoh pemakaian nyata dalam recon & bug hunting

Single URL scan

sxhttp --url https://example.com

Mass scan dengan filter status code

sxhttp --file urls.txt --threads 20 --only 200,403

Pipe dari stdin (pipe-friendly, silent)

cat urls.txt | sxhttp --only 200 --silent

TLS info + IP + favicon hash (Shodan pivot)

sxhttp --url https://example.com --tls --ip --favicon

Hash response body

sxhttp --file urls.txt --hash md5,sha256,mmh3

Lewat Burp Suite proxy

sxhttp --file urls.txt --proxy http://127.0.0.1:8080

Lewat SOCKS5 proxy

sxhttp --file urls.txt --proxy socks5://127.0.0.1:1080

POST request dengan body JSON

sxhttp --url https://example.com/api --method POST --body '{"test":1}' --header "Content-Type:application/json"

Match/filter konten body (string & regex)

sxhttp --file urls.txt --match-str "admin"
sxhttp --file urls.txt --match-regex "(?i)(dashboard|panel|admin)"
sxhttp --file urls.txt --filter-str "404 Not Found"

Simpan response body mentah

sxhttp --file urls.txt --only 200 --store-resp ./responses/

Simpan hasil dalam 3 format sekaligus

sxhttp --file urls.txt --save alive.txt --json results.json --csv results.csv

Redirect chain + default credential hints

sxhttp --url https://example.com --redirect --cred

Update ke versi terbaru

sxhttp --update

Flags

Referensi lengkap semua opsi CLI

FlagDefaultDescription

Input

--url—Single URL to scan

--file—File with URLs (one per line)

Request

--threads10Concurrent workers

--timeout10Request timeout (seconds)

--retry0Retries on failure

--rate0Max requests/second (0 = unlimited)

--methodGETHTTP method (GET, POST, HEAD, PUT, etc.)

--body—Request body for POST/PUT

--header—Custom headers: Key:Val;;Key2:Val2

--proxy—Proxy URL (http://host:port or socks5://host:port)

Filter (status code)

--only—Show only these codes (e.g. 200,403)

--exclude—Skip these codes (e.g. 404,301)

Filter (body)

--match-str—Show only responses containing string

--match-regex—Show only responses matching regex

--filter-str—Exclude responses containing string

--filter-regex—Exclude responses matching regex

Probes

--ipfalseResolve and show IP address

--tlsfalseShow TLS version, cipher, CN, expiry, SANs

--faviconfalseFetch favicon + mmh3 hash (Shodan: http.favicon.hash)

--hash—Hash response body: md5,sha256,mmh3

Output

--save—Save matched URLs to text file

--json—Save full results as JSON

--csv—Save full results as CSV

--store-resp—Directory to store raw response bodies

--silentfalsePrint URLs only (pipe-friendly)

--no-waffalseDisable WAF detection

--no-techfalseDisable tech stack detection

--no-titlefalseDisable title grabbing

--no-sizefalseDisable content length display

--credfalseShow default credential hints

--redirectfalseShow redirect chain for 3xx

--updatefalseSelf-update to latest release

Project Structure

Arsitektur kode yang modular dan maintainable

sxhttp/
├── main.go                    # Entry point, CLI flags, worker pool
├── go.mod
├── internal/
│   ├── color/color.go         # ANSI color constants + helpers
│   ├── version/version.go     # Version constant + repo path
│   ├── updater/updater.go     # GitHub release check + self-update
│   ├── banner/banner.go       # ASCII banner + version display
│   ├── detect/
│   │   ├── detect.go          # WAF, tech stack, CMS, title detection
│   │   ├── hash.go            # MD5, SHA256, MurmurHash3, favicon hash
│   │   └── tls.go             # TLS certificate info extraction
│   ├── checker/checker.go     # HTTP client, proxy, URL probing logic
│   └── output/output.go       # Result printing + file saving (JSON/CSV/txt)

sxhttp

Overview

Install

Usage

Flags

Project Structure

Punya proyek menarik buat dibangun?