secureCodeBox / secureCodeBox/secureCodeBox

➹ Check if HTTP Services are redirecting to HTTPS correctly

Open
#210 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

scanner
Dominant language
Go
Stars
988
Forks
184
Avg merge
1d 23h
Merged PRs (30d)
42

Description

Is your feature request related to a problem? Please describe.
As a security tester i'm using the secureCodeBox to check the external attack surface of different environments, e.g. K8S Clusters with services exposed to the internet. The AMASS Scanner is a great to identify all public service exposed to the internet. As a common policy in organisations it should be checked somehow if all found HTTP (e.g. Port 80, 8080) Services are redirecting the user to an HTTPS Service correctly.

Describe the solution you'd like
Maybe this can be done by additional NMAP Auth Scripts or ZAP or a new Scanner 🤔?

The result should be a finding with indicates if there are HTTP Service with a missing HTTPS redirect.

tbd.

Describe alternatives you've considered

Additional context

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the AMASS Scanner documentation and comparing the suggested NMAP Auth Scripts, ZAP integration, and a new scanner approach. Define how HTTP services and their HTTPS redirects would be checked, then confirm that a missing redirect produces a security finding with the expected result format.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.