HackBlue

Tools · Attack surface inventory · 21 / 23

httpx: the length is this response

A length on an httpx line is the size recorded for that one response. It is not a count of pages, users, or files. Write it with the URL and the status, and do not turn the number into a population.

11 min read · practice only with authorization

The number belongs to this answer

The line can include a length for the response that came back from the URL you probed. That integer is how large that answer was, in the unit the tool printed. It describes this response. It does not count other URLs, and it does not count people.

A second URL is a second line with its own length. Do not add the lengths and call the sum a site map.

Status and length are both on the line

The status code and the length can sit next to each other. The code is how the server labeled the response. The length is the size. Neither field is a title, and neither field is a list of links inside the body unless the line actually printed those links.

If the length field is missing, write “length not on this line.” Do not estimate it from the status.

What to file

File the URL, the time, the status, and the length labeled as the size of that response. If you say “412,” say 412 of what. A sentence about how many pages exist needs a different measurement.

Worked case: 412 read as 412 pages

A lab line for https://status.lab.example shows status 200 and length 412. A draft says the status site has 412 pages because the number is large for a single notice.

The note quotes the URL, status 200, and length 412 as the size of this response. It does not say 412 pages. No other URL was on the line, so no other page is counted.

Snippet
url: https://status.lab.example
status: 200
length: 412
unit: size of this response
pages named: none
write: one response, size 412
not: 412 pages

Diagram

What the length field is not counting

It is the size of the response on that line.

  • This response

    The size the line recorded for this URL.

  • Not pages

    A page count would name pages. This field does not.

  • Not users

    No account list is in the length.

  • Another URL

    Needs its own line and its own length.

Check yourself

1. A line shows length 412 for one URL. What is 412?

2. You want a page count. Where does it come from?

3. The line has a status and no length. What do you write for the size?