Adaptive Fingerprinting: HTTP-Basma's Multi-Stage Probing…

HTTP-Basma fires a crafted, multi-stage sequence of HTTP probes at a target and distills how it responds — status lines, headers, allowed methods, edge-case handling — into a compact, comparable fingerprint. Same behavior → same fingerprint, no matter what the Server header claims.

At https://httpbasma.netomize.ca/ you can:

🔎 Fingerprint any server (HTTP/HTTPS, any port) 🧬 Demangle a fingerprint to see exactly what each probe revealed ⚖️ Compare two servers component-by-component 🗂️ Search the database for other servers that share a fingerprint ↔️ Convert between the detailed (Verbosus) and compact (Pacto) formats

Built for security research, recon, attack-surface mapping, and infrastructure analysis.

✅ Free to try 📱 Mobile-friendly 🔓 Open-source engine

The methodology is documented in our paper, "Adaptive Fingerprinting: HTTP-Basma's Multi-Stage Probing for Granular Server Differentiation."

👉 Try it: https://httpbasma.netomize.ca/ ⭐ Code: https://github.com/Netomize/HTTP-Basma

Impact

The tool enables detailed server fingerprinting that can aid security researchers and threat actors in identifying and differentiating servers based on their HTTP behavior. While it enhances reconnaissance capabilities, it is not itself a vulnerability or exploit. There is no evidence of known exploits in the wild associated with this tool. The impact is primarily on information gathering and attack surface mapping.

Defensive guidance

This is a reconnaissance tool rather than a vulnerability. No direct mitigation is required. Organizations should be aware that HTTP-Basma can fingerprint servers based on HTTP behavior and consider this in their threat modeling. Standard best practices for minimizing information leakage in HTTP responses may reduce fingerprinting accuracy but are not specifically addressed by this tool's documentation.

Summary

HTTP-Basma performs adaptive fingerprinting by sending a sequence of crafted HTTP probes to a target server and distilling the responses into compact fingerprints. These fingerprints capture subtle server behaviors and allow comparison and identification of servers beyond superficial headers. The tool supports fingerprint demangling, comparison, database searching, and format conversion. It is designed for security research and reconnaissance purposes, enabling detailed server behavior analysis.

Adaptive Fingerprinting: HTTP-Basma's Multi-Stage Probing for Granular Server Differentiation

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 2 Jun 2026, 15:33 UTC

Technical details

References

Community reviews

Related threats