search

4elta / recon

automate the boring stuff!
GNU General Public License v3.0
8 stars 3 forks source link

Nmap identification of HTTPS services #45

Open 4elta opened 1 year ago

4elta commented 1 year ago

sometimes, Nmap identifies HTTPS services as ssl/http and sometimes as ssl/https. in the XML result, both services have tunnel="ssl".

$ sudo nmap -sS -Pn -p 443 -sV www.mozilla.org letsencrypt.org
...
Nmap scan report for www.mozilla.org (13.32.10.48)
Host is up (0.036s latency).
rDNS record for 13.32.10.48: server-13-32-10-48.vie50.r.cloudfront.net

PORT    STATE SERVICE  VERSION
443/tcp open  ssl/http Amazon CloudFront httpd

...
Nmap scan report for letsencrypt.org (34.141.55.250)
Host is up (0.049s latency).
Other addresses for letsencrypt.org (not scanned): 34.159.137.246 2a05:d014:275:cb01::c8 2a05:d014:275:cb00::c8
rDNS record for 34.141.55.250: 250.55.141.34.bc.googleusercontent.com

PORT    STATE SERVICE   VERSION
443/tcp open  ssl/https Netlify
1 service unrecognized despite returning data. ...
...

since commit 784b36ace47e7d6c6c0af37a816978bcc7c9f5b2 this behaviour is no longer an issue. however, i would like to understand the reason for this behaviour.

4elta commented 1 year ago

i found one StackExchange post/question about the difference between ssl/https and plain https in nmap output. but even the answer nor the link to some Nmap documentation isn't helpful.