HackBlue

Tools · Attack surface inventory · 09 / 23

httpx: one response line is one moment

An httpx line is the status, title, headers, and address from one request at one time. Write those fields as observed. A title is not an owner, and a server header is not a confirmed product.

11 min read · practice only with authorization

Each column is one observation

The URL is what was requested. The status is the code that came back to this probe. The title is the HTML title in that response, if one was parsed. The server column is the Server header the response sent, or empty. The address is the one this connection used.

None of those fields is the organization’s name for the service, and none of them is a promise that the next request will match. A name can point at more than one address. This line is the address that answered.

What to file with the line

File the URL, status, title, server header as sent, address, and the UTC time of the probe. If the run was rate-limited, the time still belongs on the note so a later run can be told apart. Do not copy the title into a sentence like “the service is healthy.” Health is a check you define, not a column.

Worked case: a title read as a health check

The probe at 2026-11-03T14:22:08Z records https://status.hackblue-lab.org, status 200, title “Lab status”, server header nginx, address 198.51.100.7. There is no version in the line. A draft says production nginx is healthy.

The note quotes the URL, the time, the status, the title, the header as sent, and the address. It says the title is the page’s title, not a health result, and the header does not name a version. The host on the URL is the status name, not a production claim the line never made.

Snippet
probed: 2026-11-03T14:22:08Z
url: https://status.hackblue-lab.org
status: 200
title: Lab status
server header: nginx
address: 198.51.100.7
not in the line: a version, a health verdict, a second address

Diagram

The columns versus the sentences people write

Stay with the observation.

On the line

Status. The code this probe received

Title. The HTML title that was parsed

Server. The header text that was sent

Address. The address this connection used

Not on the line

Health. A judgment you did not measure

Version. Unless the header or title actually contains one

Every address. Only the one that answered this time

Check yourself

1. The server column says nginx and nothing else. What may you write?

2. Status 200 and a title of “Lab status” show what?

3. Why record the probe time?