Nuclei HTTP vs HTTPS default scheme problems

[matejsmycka]

Nuclei HTTP probe

nuclei/pkg/utils/http_probe.go

Line 19 in ff5734b

func ProbeURL(input string, httpxclient *httpx.HTTPX) string {

defaults to https.

This is correct in most cases; however, this does not work on sites that return different responses for HTTPS and HTTP.

For example, this scenario:

• Port 8080
• On HTTPS returns 404
• On HTTP returns Traefik panel

I know this is a problem with the server; it's probably a misconfigured proxy somehow. However, I would expect Nuclei to choose the correct scheme.

For example:

If port > 1024:
   response1 = req(https://<>)
   if error:
       # HTTP only port

   response2 = req(http://<>)
    if error:
       # not HTTP port


  if response1.status_code != response2.status_code:
     #  HTTP and HTTPS both
``