https-redirect

NSE detection rule by Unknown · Same as Nmap--See https://nmap.org/book/man-legal.html

Check for HTTP services that redirect to the HTTPS on the same port.

local comm = require "comm"
local string = require "string"
local shortport = require "shortport"
local nmap = require "nmap"
local url = require "url"
local U = require "lpeg-utility"


description = [[
Check for HTTP services that redirect to the HTTPS on the same port.
]]

author = {"Daniel Miller"}

license = "Same as Nmap--See https://nmap.org/book/man-legal.html"

categories = {"version"}

portrule = function (host, port)
  if (port.version and port.version.service_tunnel == "ssl") then
    -- If we already know it's SSL, bail.
    return false
  end
  -- Otherwise, match HTTP services
  -- always respecting version_intensity
  return (shortport.http(host, port) and nmap.version_intensity() >= 7)
end

action = function (host, port)
  local responses = {}
  -- Did the service engine already do the hard work?
  if port.version and port.version.service_fp then
    -- Probes sent, replies received, but no match.
    -- Loop through the probes most likely to receive HTTP responses
    for _, p in ipairs({"GetRequest", "HTTPOptions", "FourOhFourRequest", "NULL"}) do
      responses[#responses+1] = U.get_response(port.version.service_fp, p)
    end
  end
  if #responses == 0 then
    -- Have to send the probe ourselves.
    local socket, result, proto = comm.tryssl(host, port, "GET / HTTP/1.0\r\n\r\n")

    if (not socket) then
      return nil
    end
    socket:close()
    if proto == "ssl" then
      -- Unlikely, but we could have negotiated SSL already.
      port.version.service_tunnel = "ssl"
      nmap.set_port_version(host, port, "softmatched")
      return nil
    end
    responses[1] = result
  end

  for _, result in ipairs(responses) do
    -- Match HTTP redirects, status 3XX
    if string.match(result, "^HTTP/1.[01] 3%d%d") then

      local location = string.match(result, "\n[Ll][Oo][Cc][Aa][Tt][Ii][Oo][Nn]:[ \t]*(.-)\r?\n")
      if location then
        local parsed = url.parse(location)
        -- Check for a redirect to the same port, but with HTTPS scheme.
        if parsed.scheme == 'https' and tonumber(parsed.port or 443) == port.number and (
            -- ensure it's not some other machine
            parsed.ascii_host == host.ip or
            parsed.ascii_host == host.targetname or
            parsed.ascii_host == host.name or
            parsed.host == "" or parsed.host == nil
            ) then
          port.version.service_tunnel = "ssl"
          nmap.set_port_version(host, port, "softmatched")
          return nil
        end
      end
    end
  end
end

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

45a24153-770e-4028-9eec-d56578c50b8c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion