secureCodeBox / secureCodeBox/secureCodeBox
➹ Check if HTTP Services are redirecting to HTTPS correctly
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 988
- Forks
- 184
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 42
Description
Is your feature request related to a problem? Please describe.
As a security tester i'm using the secureCodeBox to check the external attack surface of different environments, e.g. K8S Clusters with services exposed to the internet. The AMASS Scanner is a great to identify all public service exposed to the internet. As a common policy in organisations it should be checked somehow if all found HTTP (e.g. Port 80, 8080) Services are redirecting the user to an HTTPS Service correctly.
Describe the solution you'd like
Maybe this can be done by additional NMAP Auth Scripts or ZAP or a new Scanner 🤔?
The result should be a finding with indicates if there are HTTP Service with a missing HTTPS redirect.
tbd.
Describe alternatives you've considered
Additional context
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the AMASS Scanner documentation and comparing the suggested NMAP Auth Scripts, ZAP integration, and a new scanner approach. Define how HTTP services and their HTTPS redirects would be checked, then confirm that a missing redirect produces a security finding with the expected result format.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100