Tools · Attack surface inventory · 09 / 23
httpx: one response line is one moment
An httpx line is the status, title, headers, and address from one request at one time. Write those fields as observed. A title is not an owner, and a server header is not a confirmed product.
Each column is one observation
The URL is what was requested. The status is the code that came back to this probe. The title is the HTML title in that response, if one was parsed. The server column is the Server header the response sent, or empty. The address is the one this connection used.
None of those fields is the organization’s name for the service, and none of them is a promise that the next request will match. A name can point at more than one address. This line is the address that answered.
A header is what was sent, not a build record
A Server header can be a generic word with no version. Tech-detect output, when you asked for it, is the probe’s guess from that response. Write it as a guess. Do not write a version the line does not contain, and do not treat the header as the vendor’s advisory list.
A 200 means this URL returned 200 to this probe. It does not mean the application is the production system, or that the page is the one operators think is live.
What to file with the line
File the URL, status, title, server header as sent, address, and the UTC time of the probe. If the run was rate-limited, the time still belongs on the note so a later run can be told apart. Do not copy the title into a sentence like “the service is healthy.” Health is a check you define, not a column.
Worked case: a title read as a health check
The probe at 2026-11-03T14:22:08Z records https://status.hackblue-lab.org, status 200, title “Lab status”, server header nginx, address 198.51.100.7. There is no version in the line. A draft says production nginx is healthy.
The note quotes the URL, the time, the status, the title, the header as sent, and the address. It says the title is the page’s title, not a health result, and the header does not name a version. The host on the URL is the status name, not a production claim the line never made.
probed: 2026-11-03T14:22:08Z url: https://status.hackblue-lab.org status: 200 title: Lab status server header: nginx address: 198.51.100.7 not in the line: a version, a health verdict, a second address
Diagram
The columns versus the sentences people write
Stay with the observation.
Status. The code this probe received
Title. The HTML title that was parsed
Server. The header text that was sent
Address. The address this connection used
Health. A judgment you did not measure
Version. Unless the header or title actually contains one
Every address. Only the one that answered this time
Check yourself
1. The server column says nginx and nothing else. What may you write?
2. Status 200 and a title of “Lab status” show what?
3. Why record the probe time?