humble

No entries match these filters. Clear filters

1. 1.68 Oct 31, 2026 · issue 127

   humble adds Markdown export and now shows how many days behind the latest version you are with -v⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSIONDockergit

   Docker copy

   $ docker pull ghcr.io/rfc-st/humble:1.68

   git copy

   $ git clone --branch 1.68 https://github.com/rfc-st/humble.git
   # already have the repo? check out this version:
   $ git checkout 1.68

   published under the project's GitHub account · checked 1 Nov

   ▶ ⤢
   └──▷ TRY IT
   Check whether your installed copy of humble is behind the latest release and by how many days.
   copy

   $ python humble.py -v

   • Export analysis results to Markdown format with -o md.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Show how many days behind the latest release the installed version is with -v.
   • Adds 16 new insecure header checks across multiple categories.
   • Export analysis results to Markdown format with -o md.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

2. 1.67 Oct 9, 2026 · issue 100

   humble 1.67 adds 7 new insecure checks, 1 fingerprint header, improved XML export, and 7 total new detection/feature items.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.67 https://github.com/rfc-st/humble.git
   # already have the repo? check out this version:
   $ git checkout 1.67

   ▶ ⤢
   • Adds 7 new insecure header checks, expanding deprecated/insecure-value detection coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds 1 new fingerprint header to the fingerprint detection database.
   • Significantly improves XML export output.
   • Adds 4 new features (details in extended commit message for 127f815).
   • Adds 3 new features (details in extended commit message for da29ca2).

   +1 more show less

   • Improves the -v verbose check.
   • Adds 7 new insecure header checks, expanding deprecated/insecure-value detection coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds 4 new features (details in extended commit message for 127f815).
   • Adds 3 new features (details in extended commit message for da29ca2).

   3 more in Everything

3. 1.66 Sep 19, 2026 · issue 080

   humble 1.66 adds 1 new fingerprint header, 2 new insecure checks, and an improved Set-Cookie: Invalid Prefixes check.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.66 https://github.com/rfc-st/humble.git
   # already have the repo? check out this version:
   $ git checkout 1.66

   ▶ ⤢
   • Adds 1 new fingerprint header to the detection database, expanding coverage to assist in server/software identification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds 2 new insecure header value checks to the deprecated/insecure checks suite.
   • Improves the Set-Cookie: Invalid Prefixes check with broader or more accurate detection logic.
   • Adds 1 new fingerprint header to the detection database, expanding coverage to assist in server/software identification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

4. 1.65 Aug 29, 2026 · issue 059

   humble 1.65 adds 3 new fingerprint headers and 1 new insecure check to its HTTP header analysis engine.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.65 https://github.com/rfc-st/humble.git
   # already have the repo? check out this version:
   $ git checkout 1.65

   ▶ ⤢
   • Adds 3 new fingerprint headers to the detection database (commits b83d699 and 732522f), expanding coverage to identify server/framework exposure via HTTP response headers.
   • Adds 1 new insecure value check (commit 3b59c53), increasing the total insecure/deprecated header checks.

   2 details in Everything

5. 1.64 Jul 31, 2026 · issue 032

   humble 1.64 adds multiple output format support, redirect totals in Info section, and an improved AI SKILL file.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.64 https://github.com/rfc-st/humble.git
   # already have the repo? check out this version:
   $ git checkout 1.64

   ▶ ⤢
   • Supports exporting analysis results in multiple output formats simultaneously via a single invocation.
   • Shows the total number of redirects in the Info section of each analysis.
   • Adds improved redirect information detail in analysis output.
   • Adds 1 new fingerprint header detection to the fingerprint checks database.
   • Greatly improved SKILL file for AI-assisted workflows.

   5 details in Everything

6. 1.63 Jul 8, 2026 · issue 009

   humble 1.63 adds HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. file analysis via -if and a new insecure header check.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.63 https://github.com/rfc-st/humble.git
   # already have the repo? check out this version:
   $ git checkout 1.63

   ▶ ⤢
   └──▷ TRY IT
   Analyze a captured HAR file from a browser session to audit its HTTP response headers without making live requests.
   copy

   $ python humble.py -if <path/to/capture.har>

   • Supports analyzing HAR (HTTP Archive) files as input via the -if option, enabling offline inspection of captured browser traffic.
   • Adds 1 new insecure header check, expanding detection coverage.

   2 details in Everything

7. 1.62 Jun 20, 2026 · release notes

   humble 1.62 adds grade-gating for CI/CD, a global header skip file, and 2 new fingerprint headers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.62 https://github.com/rfc-st/humble.git
   # already have the repo? check out this version:
   $ git checkout 1.62

   └──▷ TRY IT
   Fail a CI pipeline automatically when the analysis result does not meet a required grade.
   copy

   $ python humble.py -u https://example.com -cicd A

   • Adds -cicd option to specify a required grade, enabling pass/fail gating in CI/CD pipelines.
   • Introduces humble.skip file to globally exclude specific headers from analysis across all scans.
   • Adds 2 new fingerprint headers for improved server technology detection.

   3 details in Everything

8. 1.62 Jun 20, 2026 · issue 001

   humble 1.62 adds required-grade CI/CD gating, a global header skip file, and 2 new fingerprint header checks.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.62 https://github.com/rfc-st/humble.git
   # already have the repo? check out this version:
   $ git checkout 1.62

   ▶ ⤢
   └──▷ TRY IT
   Fail a CI/CD pipeline only when the target scores below a required grade — useful for enforcing a minimum security bar on every PR.
   copy

   $ python humble.py -u https://example.com -cicd <required_grade>

   Permanently exclude noisy or internal-only headers from every analysis without touching individual scan commands.
   copy

   $ echo 'X-Internal-Header' >> humble.skip && python humble.py -u https://example.com

   • Adds required-grade enforcement to the -cicd option, letting pipelines fail when a scan doesn't meet a specified minimum grade.
   • Introduces humble.skip file support to globally exclude specific HTTP response headers from all analyses.
   • Adds 2 new fingerprint header detections, expanding the fingerprint check count.

   3 details in Everything

9. 1.61 May 16, 2026 · release notes

   humble 1.61 adds 4 new fingerprint headers to its detection ruleset.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.61 https://github.com/rfc-st/humble.git
   # already have the repo? check out this version:
   $ git checkout 1.61

   • Adds 4 new fingerprint headers to improve technology/server identification during HTTP header analysis.

   1 detail in Everything

10. 1.60 May 1, 2026 · release notes

    humble 1.60 adds AI-driven security analysis and 2 new fingerprint header detections.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.60 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.60

    • Adds AI-driven security analysis to HTTP header assessments.
    • Detects 2 new fingerprint headers.

    2 details in Everything

11. 1.59 Mar 27, 2026 · release notes

    humble 1.59 adds 32 new fingerprint headers, a new insecure check, and an all export format shortcut including XLSX.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.59 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.59

    └──▷ TRY IT
    Export a full header analysis in every supported format (HTML, PDF, TXT, XLSX) in one shot.
    copy

    $ python humble.py -u https://example.com -e all

    • Adds 1 new insecure header/value check to expand security analysis coverage.
    • Supports value all when exporting analyses to output all supported formats at once.
    • Adds XLSX as a supported export format, included when using the all export option.
    • Adds file path to the results of the -cicd option for clearer CI/CD pipeline output.

    4 details in Everything

12. 1.58 Feb 14, 2026 · release notes

    humble 1.58 adds 7 new fingerprint headers and updated HTTP response header checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.58 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.58

    • Updates HTTP response header checks and references for broader security coverage.

    1 detail in Everything

13. 1.57 Jan 2, 2026 · release notes

    humble 1.57 adds 2 new insecure header checks and reaches 95% unit test coverage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.57 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.57

14. 1.55 Nov 21, 2025 · release notes

    humble 1.55 adds enhanced write permission checks and launches HTML API docs via MkDocs and Read the Docs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.55 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.55

    • Enhances write permission checks for restricted environments, improving reliability when running humble in locked-down or read-only contexts.
    • Publishes HTML documentation for classes and functions via MkDocs and Read the Docs, giving contributors and integrators browsable API reference.
    • Adds Bandit static security scanning to the project's CI pipeline.

    3 details in Everything

15. 1.54 Oct 24, 2025 · release notes

    humble 1.54 adds JSON export for detailed analyses and a new -H parameter for header injection checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.54 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.54

    └──▷ TRY IT
    Use the new -H parameter to supply custom headers during analysis.
    copy

    $ python humble.py -u https://example.com -H

    • Adds ability to export detailed HTTP header analyses to JSON format, including support for Spanish-language output.
    • Introduces new -H parameter for additional header-related checks.
    • Adds checks on PATHs and restricted environments.
    • Adds localization (l10n) of errors and messages in unit tests.

    4 details in Everything

16. 1.53 Sep 13, 2025 · release notes

    humble 1.53 adds CI/CD JSON output mode and a new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. session header security check

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.53 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.53

    └──▷ TRY IT
    Fail a CI/CD pipeline based on machine-readable analysis totals instead of human-formatted output
    copy

    $ python3 humble.py -u https://example.com -cicd

    • New -cicd parameter outputs analysis totals in JSON format, suitable for CI/CD pipeline integration
    • New insecure header detection: Mcp-Session-Id — Potentially Unsafe Value
    • Updated OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Secure Headers project best practices coverage
    • Updated Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. directive definitions

    4 details in Everything

17. 1.52 Aug 16, 2025 · release notes

    humble 1.52 adds XLSX export, collapsible HTML reports, a new missing-header detection, and 4 new fingerprint headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.52 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.52

    • Adds XLSX (Excel 2007+) export of analysis results (requires xlsxwriter).
    • Makes HTML sections collapsible in exported analysis reports.
    • Detects 1 new missing header: Integrity-Policy.
    • Adds 2 new insecure header checks.
    • Adds 4 new fingerprint headers to detection.

    +1 more show less

    • Adds unit test suite (requires pytest).

    6 details in Everything

18. 1.51 Jul 27, 2025 · release notes

    humble 1.51 adds proxy support, 11 new insecure header checks, and warnings for unreachable URLs and blocked scans.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.51 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.51

    └──▷ TRY IT
    Route humble's HTTP analysis through a local intercepting proxy (e.g., Burp Suite) to inspect or test headers on an internal host.
    copy

    $ python3 humble.py -u https://internal.example.com -p http://127.0.0.1:8080

    • New -p flag routes analysis traffic through a proxy, enabling scanning of internal or restricted targets.
    • Adds 11 new insecure header checks across four commits, expanding detection coverage.
    • Warns when IP blocking or tool interference may produce unreliable results.
    • Displays a warning when no HTTP response headers are received from a target.
    • Adds 1 new fingerprint header detection.

    +2 more show less

    • Normalizes response HTTP header values for more consistent analysis output.
    • Improved OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Secure Headers Project Best Practices check.

    7 details in Everything

19. 1.50 Jun 20, 2025 · release notes

    humble 1.50 adds 9 new fingerprint headers, a first-insecure-CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks.-nonce detector, and an enhanced HTML/PDF export.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.50 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.50

    • Adds 9 new fingerprint headers to the detection ruleset (added across multiple commits).
    • Displays the first incorrect/insecure CSP nonce found after analysis, pinpointing misconfigured nonce usage.
    • Adds 1 new insecure HTTP header check to the analysis engine.
    • Enhances HTML export output for richer reporting.
    • Significantly improves spacing and layout when exporting analysis results to PDF.

    +1 more show less

    • Improves CSP unsafe-eval and unsafe-inline checks for more accurate detection.

    6 details in Everything

20. 1.49 May 8, 2025 · release notes

    humble 1.49 adds three new insecure header checks and improves Set-Cookie attribute analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.49 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.49

    • Adds 3 new insecure header/configuration checks to the analysis engine.
    • Improves Set-Cookie (Insecure Attributes) check with expanded detection coverage.

    2 details in Everything

21. 1.48 Apr 12, 2025 · release notes

    humble 1.48 adds 4 new insecure checks, 11 new fingerprint headers, and significantly improved CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. nonce and Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.48 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.48

    • Adds 11 new fingerprint headers to detection coverage.
    • Significantly improves nonce validation checks in Content-Security-Policy analysis.
    • CSP broad and insecure checks now display the specific directives containing unsafe values.
    • Improves Permissions-Policy broad checks for wider misconfiguration coverage.

    4 details in Everything

22. 1.47 Mar 7, 2025 · release notes

    humble 1.47 adds Content Security PolicyContent Security PolicyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. analysis, 13 new fingerprint headers, and 3 new insecure checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.47 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.47

    └──▷ TRY IT
    Analyze a saved response file and confirm the filename is echoed back — useful when batch-processing multiple sites in scripts.
    copy

    $ humble -if <path-to-response-file>

    • Begins Content Security Policy analysis capability.
    • Adds 13 new fingerprint headers to detection coverage.
    • Adds 3 new insecure header checks.
    • Improves OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Secure Headers Project Best Practices analysis.
    • Prints input filename when -if parameter is used.

    +1 more show less

    • Adds User-Agent and Kali Linux setup guidance.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Python 3.9 is now the minimum required version; installations running an older Python will break on upgrade.
23. 1.46 Feb 1, 2025 · release notes

    humble 1.46 adds trend analysis to URL scans, a new Referrer-Policy duplicate-value check, and 15 new fingerprint headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.46 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.46

    └──▷ TRY IT
    Run a full analysis including the new per-check trend indicators to spot headers getting worse or better over time.
    copy

    $ humble -a https://example.com

    • Adds trend data for multiple security checks when using the -a URL parameter.
    • New insecure header check: detects duplicated values in the Referrer-Policy header.
    • Adds 15 new fingerprint headers to the detection ruleset (across two updates).

    3 details in Everything

24. 1.45 Jan 3, 2025 · release notes

    humble 1.45 adds XML export, a new -c parameter, 8 new insecure header checks, and expanded CSV/XML detailed analysis support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.45 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.45

    • Adds XML export format for brief analysis results.
    • Extends XML export to support detailed analysis output.
    • Extends CSV export to support detailed analysis output.
    • Introduces new -c parameter.
    • Adds 8 new insecure header checks, including Refresh (Potentially Unsafe Header) and Cross-Origin-Opener-Policy unsafe value detections.

    +1 more show less

    • Greatly improves OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. compliance checks coverage.

    6 details in Everything

25. 1.44 Dec 4, 2024 · release notes

    humble 1.44 adds 7 new insecure header checks, 21 enabled-header detections, and extended security response header coverage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.44 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.44

    • Adds insecure check for Document-Policy header with no valid directives.
    • Adds insecure check for Activate-Storage-Access header with no valid directives.
    • Adds insecure check for Activate-Storage-Access header with incorrect values.
    • Adds insecure check for Accept-Patch as a potentially unsafe header.
    • Adds insecure checks for Content-Digest using no secure algorithms and unsafe algorithms.

    +3 more show less

    • Adds insecure check for Content-DispositionContent-DispositionAn HTTP response header that tells a browser whether to display a file inline or treat it as a download attachment, and under what filename — letting cyber tools control how retrieved files are handled or trigger forced downloads. as a potentially unsafe header.
    • Adds detection of enabled security response headers, covering 21 new security-related headers.
    • Extends the set of security response HTTP headers checked during analysis.

    8 details in Everything

26. 1.43 Nov 16, 2024 · release notes

    humble 1.43 adds Docker support, raw-file analysis, customizable export filenames, and 9 new fingerprint headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.43 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.43

    └──▷ TRY IT
    Analyze a saved raw HTTP response file offline — useful for examining captures from proxies or curl dumps without needing the live target.
    copy

    $ humble -if <path/to/raw_response_file>

    • New -if parameter enables analysis of raw HTTP response files without a live target.
    • Adds Docker support, allowing humble to run in containerized environments.
    • Customizable filenames when exporting analysis results.
    • Analysis results now included when exporting to CSV and JSON formats.
    • Highlighted headers now shown in PDF exports after analysis.

    +4 more show less

    • 9 new fingerprint headers added to detection coverage.
    • Shows enabled HTTP response headers associated with security after analysis.
    • Improved Experimental Headers output with enhanced messaging.
    • Returns absolute path for additional files generated during analysis.

    9 details in Everything

27. 1.42 Oct 18, 2024 · release notes

    humble 1.42 adds analysis results to CSV/JSON exports, 9 new fingerprint headers, and absolute path reporting for additional files.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.42 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.42

    • Exports now include analysis results when saving output to CSV or JSON formats.
    • Adds 9 new fingerprint headers to detection coverage.
    • Returns the absolute path for additional files in output.

    3 details in Everything

28. 1.41 Sep 21, 2024 · release notes

    humble 1.41 adds 31 new fingerprint headers, 2 new insecure checks, language-tagged export filenames, and experimental header detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.41 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.41

    • Adds 31 new fingerprint headers across four commits, expanding technology-detection coverage.
    • Adds 2 new insecure header checks to the security analysis.
    • Export filenames now include the language suffix, making multi-language report sets easier to distinguish.
    • Flags experimental HTTP headers within the Missing Headers check, surfacing cutting-edge or draft header recommendations.
    • Extends and improves request exception logic, broadening coverage of network error scenarios.

    5 details in Everything

29. 1.40 Aug 31, 2024 · release notes

    humble 1.40 adds 15 new fingerprint headers and two new insecure checks for Content-Type and Report-To.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.40 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.40

    • New insecure check detects unsafe values in the Content-Type header.
    • New insecure check flags the deprecated Report-To header.
    • Extends the -grd parameter to also check source files.

    3 details in Everything

30. 1.39 Aug 5, 2024 · release notes

    humble 1.39 adds analysis grading with a new -grd parameter, highlights unsupported headers, and expands fingerprint detection with 4 new headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.39 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.39

    └──▷ TRY IT
    Get a graded summary of a site's HTTP header security posture, useful for quick triage or reporting.
    copy

    $ python humble.py -u https://example.com -grd

    • New -grd parameter to display the grade of the analysis and advices.
    • Highlights unsupported headers in analysis output.
    • Extends skipped headers functionality to cover missing headers as well.
    • Shows the license, permissions, and limitations of humble directly in the tool.
    • Includes the name of the exported file in its contents.

    5 details in Everything

31. 1.38 Jul 6, 2024 · release notes

    humble 1.38 adds a new insecure check and improved PDF export formatting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.38 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.38

    └──▷ TRY IT
    Export an analysis report to PDF where the new line spacing and header highlighting make the output more readable.
    copy

    $ humble analyze --format pdf

    • Adds a new insecure check to the analysis engine
    • Improves skipped headers message clarity
    • Enhances line spacing when exporting to PDF
    • Adds support for 2 new fingerprint headers
    • Highlights HTTP response headers in PDF exports

    +2 more show less

    • Improves the default file name format when exporting analysis results
    • Improves Global Statistics presentation

    7 details in Everything

32. 1.37 Jun 1, 2024 · release notes

    Adds -ua parameter for custom User-Agents, 14 new fingerprint headers, and enriched global stats to humble v1.37

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.37 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.37

    • Adds -ua parameter to specify custom User-Agent strings during scanning
    • Adds 14 new fingerprint headers for enhanced detection capabilities
    • Enriches global statistics output with more detailed informational fields

    3 details in Everything

33. 1.36 Apr 26, 2024 · release notes

    Adds HTML export capability for fingerprinting results and supports new insecure checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.36 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.36

    • Adds support for multiple new insecure checks in HTTP header analysis
    • Adds detection for two new fingerprint headers

    2 details in Everything

34. 1.35 Mar 27, 2024 · release notes

    Adds -s parameter to humble for selecting insecure checks, plus new HTML export capability.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.35 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.35

    • Adds the -s parameter to enable selective insecure checks
    • Supports Vary: Potentially Unsafe Header as a new insecure check
    • Adds two additional new insecure checks
    • Adds another two new insecure checks
    • Allows exporting results to HTML via a new function and template

    +1 more show less

    • Noted analysis type when exporting to CSV or JSON

    6 details in Everything

35. 1.34 Feb 17, 2024 · release notes

    Adds NEL and Content-Security-Policy Unsafe Directive insecure checks plus 4 new fingerprint headers to humble

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.34 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.34

    • Adds two new insecure checks for NEL (Strict-Transport-Conversion-Error) and CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. (Unsafe Directive)
    • Adds 4 new HTTP security headers for fingerprinting analysis
    • Improves HTML export output with additional meta tags

    3 details in Everything

36. 1.33 Jan 19, 2024 · release notes

    humble v1.33 adds -ua flag for custom User-Agent and shows version/best-worst stats in global statistics

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.33 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.33

    └──▷ USE IT
    Scan a target while impersonating a specific browser to evade basic bot detection.
    shell copy

    humble -ua "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" https://example.com

    • Adds -ua CLI argument to supply a customized User-Agent string during analysis
    • Shows the tool version within the analysis output
    • Displays best and worst results in the global statistics view

    3 details in Everything

37. 1.32 Dec 22, 2023 · release notes

    Humble 1.32 adds CSV export via -op flag and several new insecure header checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.32 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.32

    • Adds the -op parameter to specify the PATH where the analysis will be exported
    • Enables CSV export for brief analysis output (supported format: CSV)
    • Adds Set-Cookie: Cookie Prefixes insecure check
    • Adds Origin-Agent-Cluster: No Valid Directives insecure check
    • Adds Proxy-Authenticate: Unsafe Value insecure check

    5 details in Everything

38. 1.31 Nov 30, 2023 · release notes

    humble 1.31 adds TLS/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. checks, multiple new insecure checks, and -r parameter for JSON generation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.31 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.31

    └──▷ USE IT
    Export JSON results with the new -r parameter to refine generation logic.
    shell copy

    humble --output json -r <target>

    Analyze a target's TLS/SSL configuration without following redirects.
    shell copy

    humble -df <target>

    • Adds -r parameter to JSON output to control generation behavior
    • Adds -df flag to skip following HTTP redirects
    • New TLS/SSL check capability for certificate validation
    • New insecure check for deprecated X-XSS-Protection header
    • New insecure check for unsafe SourceMap functionality

    +1 more show less

    • New insecure check for invalid directives in Surrogate-Control header

    6 details in Everything

39. 1.30 Nov 8, 2023 · release notes

    humble v1.30 adds JSON output with fingerprint header and missing header detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.30 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.30

    • humble now checks for the X-Permitted-Cross-Domain-Policies HTTP security header as a new default fingerprint/missing check.

    1 detail in Everything

40. 1.28 Sep 2, 2023 · release notes

    humble v1.28 adds multiple new insecure checks and fingerprint headers for CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. and other security policies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.28 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.28

    • Adds detection for the Expires: Ignored header directive in Content-Security-Policy analysis.
    • Adds detection for the Keep-Alive: Ignored header directive in Content-Security-Policy analysis.
    • Adds detection for Transfer-Encoding: No Valid Directives in Content-Security-Policy analysis.
    • Adds detection for Strict-Dynamic: Incorrect header value in Content-Security-Policy analysis.

    4 details in Everything

41. 1.27 Aug 4, 2023 · release notes

    Adds new CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. insecure check for IP detected values and a new disown-opener deprecated directive support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.27 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.27

    • Adds new insecure check for Content-Security-Policy with detected IP addresses
    • Adds support for the disown-opener deprecated directive in Content-Security-Policy checks

    2 details in Everything

42. 1.26 Jul 11, 2023 · release notes

    humble 1.26 adds -f term filtering for fingerprint analytics and numerous new security checks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.26 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.26

    • -f <TERM> parameter to show statistics for fingerprint headers related to a specific term
    • -f (without TERM) now shows the Top 20 fingerprint headers
    • New insecure check: Digest (Deprecated Header)
    • New insecure check: Content-Security-Policy-Report-Only (Deprecated Directives)

    4 details in Everything

43. 1.25 Jun 16, 2023 · release notes

    Adds global statistics across analyses and includes subdomain/TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. in export file names.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.25 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.25

    • Subdomain and TLD now included in the export file name
    • Adds global statistics of all analyses performed

    2 details in Everything

44. 1.24 May 20, 2023 · release notes

    Adds insecure checks for Set-Cookie, X-Frame-Options, Referrer-Policy; adds Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. and CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. directives; new highlights output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.24 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.24

    └──▷ USE IT
    Enable the new highlights output to see why headers are flagged insecure.
    shell copy

    humble <url> --output highlights

    • Adds support for Permissions-Policy header values (e.g. geolocation, microphone).
    • Adds detection for deprecated Content-Security-Policy directives.
    • Shows explicit absence of value in fingerprint headers rather than omitting them.
    • Adds new insecure check: Set-Cookie (Missing Attribute).
    • Adds new insecure check: X-Frame-Options (Incorrect Values).

    +2 more show less

    • Adds new insecure check: Referrer-Policy (Incorrect Value).
    • Adds highlights output format to display analysis highlights.

    7 details in Everything

45. 1.23 Apr 30, 2023 · release notes

    humble 1.23 adds -a parameter with extra statistics and fingerprint headers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.23 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 1.23

    └──▷ USE IT
    Run humble in analytics mode to get detailed statistics including new warning metrics.
    shell copy

    humble -a <target>

    • Adds -a command-line flag to enable analytics mode
    • Displays total number of warnings in the output
    • Includes Warnings per analysis (Average) metric in analytics output
    • Supports 8 new fingerprint headers for analytics

    4 details in Everything

46. 2023/04/06 Apr 6, 2023 · release notes

    Adds the ability to save and compare analysis results for regression detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2023/04/06 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2023/04/06

    • Adds saving and comparing of analysis results to enable detecting regressions across runs.

    1 detail in Everything

47. 2023/03/17 Mar 17, 2023 · release notes

    Adds Set-Cookie insecure scheme detection and multiple new fingerprint headers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2023/03/17 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2023/03/17

    • Adds New insecure check: Set-Cookie (Insecure Scheme) to detect cookies over HTTP
    • Adds 1 new fingerprint header support for identifying backend technologies
    • Adds 5 new fingerprint headers to the detection list

    3 details in Everything

48. 2023/02/24 Feb 24, 2023 · release notes

    humble adds Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. insecure check and HTTP 4XX notes in reports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2023/02/24 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2023/02/24

49. 2023/02/03 Feb 3, 2023 · release notes

    Adds new insecure checks for Content-Type and HTTP Status Code

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2023/02/03 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2023/02/03

    • New insecure check: Content-Type (Non-HTML MIME type)
    • New insecure check: HTTP Status Code (Client Error)

    2 details in Everything

50. 2023/01/13 Jan 13, 2023 · release notes

    humble 2023/01/13 adds detection for X-UA-Compatible deprecated header and numerous new fingerprint headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2023/01/13 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2023/01/13

    • Adds X-UA-Compatible as a new insecure check (Deprecated Header)
    • Adds multiple new fingerprint headers to detection scope

    2 details in Everything

51. 2022/12/16 Dec 16, 2022 · release notes

    Adds PDF output format to CLI and new insecure header checks for X-Robots-Tag and Onion-Location.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/12/16 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/12/16

    └──▷ TRY IT
    Generate a PDF report of the scan results.
    copy

    $ humble <target> -f pdf

    • Adds pdf output format support
    • Adds insecure check for X-Robots-Tag (No Valid Directives)
    • Adds insecure check for Onion-Location (Potentially Unsafe Header)

    3 details in Everything

52. 2022/12/06 Dec 6, 2022 · release notes

    Adds extensive fingerprint headers and new security header checks (Content-Type, Clear-Site-Data) to humble.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/12/06 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/12/06

    • Adds support for ~47 new fingerprint headers for HTTP server identification
    • Adds Content-Type (Deprecated Values) check
    • Adds Clear-Site-Data (Ignored Header) check
    • Improves output readability for Access-Control-Allow-Methods check

    4 details in Everything

53. 2022/11/19 Nov 19, 2022 · release notes

    humble adds multiple new HTTP fingerprint headers for browser/device identification.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/11/19 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/11/19

    • Adds support for detecting numerous new HTTP response headers (including X-ET-API-Origin, X-Download-Options, and others implied by the commit titles) to identify client fingerprints.

    1 detail in Everything

54. 2022/11/07 Nov 7, 2022 · release notes

    humble adds new Content-Security-Policy directives and fingerprint headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/11/07 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/11/07

    • Update Content-Security-Policy directives
    • Add Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. feature

    2 details in Everything

55. 2022/10/28 Oct 28, 2022 · release notes

    humble adds new fingerprint headers, deprecated X-Frame-Options check, and tech display from headers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/10/28 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/10/28

    • Adds X-PHP-Version, X-Commerce-Core, and other new fingerprint headers for technology identification.
    • Introduces a new check for X-Frame-Options with deprecated values.
    • Displays software/technology information derived from fingerprint headers.

    3 details in Everything

56. 2022/10/07 Oct 7, 2022 · release notes

    Adds insecure CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. check and new fingerprint headers to humble

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/10/07 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/10/07

57. 2022/09/09 Sep 9, 2022 · release notes

    Adds new fingerprint headers, XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session./Strict-Transport-Security duplicate checks, and HTML5 output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/09/09 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/09/09

    • ff3142d adds valid HTML5 as an analysis output format
    • bb7c9f7 adds detection for X-XSS-Protection duplicated values
    • c6f0908 adds detection for Strict-Transport-Security duplicated values
    • 681edc8 adds fingerprinting support for the X-MS-Version header
    • 2176c4b adds fingerprinting support for the X-Rocket-Nginx-Serving-Static header

    +3 more show less

    • 3772f08 adds fingerprinting support for the Weglot-Translated header
    • acfb38e adds support for 3 new fingerprint headers (unspecified in notes)
    • New dependency fpdf2 drives PDF output improvements

    8 details in Everything

58. 2022/08/14 Aug 14, 2022 · release notes

    Adds end-of-analysis summary output and new fingerprint/check capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/08/14 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/08/14

    • Introduces checks for duplicated headers or values of the same header.
    • Adds support for new fingerprint headers: Platform, Processed-By, X-Spdwp-Ngx, X-Vercel-Cache, and X-Vercel-ID.
    • Adds a new insecure check for Content-Security-Policy.
    • Improves detection for deprecated/insecure descriptions and the X-Content-Type-Options insecure check.

    4 details in Everything

59. 2022/07/24 Jul 24, 2022 · release notes

    Adds new insecure/missing checkers for HTTP headers (X-Robots-Tag, Basic WWW-Authenticate, Content-Type, Expect-CT, Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header.) and fingerprint headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/07/24 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/07/24

    • Adds checks for X-Robots-Tag insecure values
    • Adds new fingerprint header check for X-Litespeed-Alt-Svc
    • Adds check for Public-Key-Pins insecure values in HTTP
    • Adds five new fingerprint header checks
    • Adds check for Basic WWW-Authenticate insecure value in HTTP

    +14 more show less

    • Adds missing check for Content-Type header
    • Adds check for Expect-CT in HTTP
    • Adds new fingerprint header check for X-Wix-Request-Id
    • Adds five new fingerprint headers related to Flywheel
    • Adds ten new fingerprint checks related to HubSpot
    • Adds new Content-Security-Policy check
    • Adds check for Strict-Transport-Security in HTTP
    • Adds new fingerprint header check for X-Magnolia-Registration
    • Adds check for insecure value of Referrer-Policy
    • Adds deprecated header check for X-Download-Options
    • Adds valid Permissions-Policy features check
    • Shows deprecated directives in Content-Security-Policy output
    • Shows general deprecated directives in output
    • Details insecure HTTP Methods enabled in output

    19 details in Everything

60. 2022/06/18 Jun 18, 2022 · release notes

    Adds checks for X-Nginx-Cache, X-Nextjs-Cache headers, Permission-Policy validation, and browser compatibility for security headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/06/18 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/06/18

    • Adds X-Nginx-Cache and X-Nextjs-Cache fingerprint detection.
    • Enables checks for incorrect Permission-Policy values.
    • Adds browser compatibility checking for enabled security headers.

    3 details in Everything

61. 2022/05/21 May 21, 2022 · release notes

    Added fingerprint and deprecated header checks plus CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. directive validation in humble

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/05/21 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/05/21

    • Adds X-Hudson, X-Jenkins, X-Jenkins-Session, X-CMS-Version, X-Generated-By, X-Cache-Type and X-Bitrix-Composite header fingerprint checks
    • Adds X-Pad, X-Content-Security-Policy and X-Webkit-CSP deprecated header checks
    • Enables detection of available and obsolete CSP directives

    3 details in Everything

62. 2022/04/02 Apr 2, 2022 · release notes

    humble adds checks for 10 new fingerprint headers and validates Content-Security-Policy directives

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/04/02 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/04/02

    • Added checks for 10 new fingerprint headers: X-Drupal-Cache-Contexts, X-Drupal-Cache-Tags, Product, X-Using-Nginx-Controller, SPIisLatency, SPRequestDuration, SPRequestGuid, X-MS-InvokeApp, X-SharePointHealthScore and WP-Super-Cache.
    • Added check to verify Content-Security-Policy contains at least one valid directive.
    • Added capability to block russian domains.

    3 details in Everything

63. 2022/01/01 Jan 1, 2022 · release notes

    Adds 9 new header fingerprint detection checks (X-Magento-Cache-Control, X-Varnish-CC, etc.)

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2022/01/01 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2022/01/01

    • humble now detects 9 specific HTTP fingerprint headers: X-Magento-Cache-Control, X-Magento-Cache-Debug, X-ServerName, X-Server-Name, X-TEC-API-ORIGIN, X-TEC-API-ROOT, X-TEC-API-VERSION, X-Varnish-Cache and X-Varnish-CC

    1 detail in Everything

64. 2021/12/08 Dec 8, 2021 · release notes

    Adds detection for 4 new fingerprint headers and checks against insecure values Allow and Access-Control-Allow-Methods.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2021/12/08 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2021/12/08

    • New fingerprint headers: Oracle-Mobile-Runtime-Version, X-AH-Environment, X-ORACLE-DMS-ECID and X-ORACLE-DMS-RID

    1 detail in Everything

65. 2021/12/05 Dec 5, 2021 · release notes

    humble adds detection for seven new HTTP fingerprint headers (Hummingbird-Cache, X-Accel-*) and reorders output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2021/12/05 https://github.com/rfc-st/humble.git
    # already have the repo? check out this version:
    $ git checkout 2021/12/05

    └──▷ USE IT
    Scan a target to check for specific Nginx, Hummingbird, or Shopify fingerprinting headers that might indicate server infrastructure.
    shell copy

    humble example.com | grep -E 'Hummingbird-Cache|X-Accel-Buffering|X-Accel-Redirect'

    • humble now detects the Hummingbird-Cache, X-Accel-Buffering, X-Accel-Redirect, X-Accel-Charset, X-Accel-Expires, X-Accel-Limit-Rate, and X-Shopify-Request-Trackable HTTP headers for server fingerprinting
    • humble output now sorts the missing and insecure value headers section

    2 details in Everything