📡

Https (Tcp 443)

Notes from oscp.adot8.com — services.

#services#adot8

HTTPS <tcp 443>

Same attack surface as HTTP + a cert that leaks subject/SAN hostnames.

code

01nmap -p443 --script "ssl-cert,ssl-enum-ciphers,http-title,http-methods,http-headers,http-server-header,vulners" -sV $ip

code

01openssl s_client -connect $ip:443 -showcerts </dev/null 2>/dev/null | openssl x509 -noout -text | grep -E "Subject:|DNS:"

Every DNS: entry → add to /etc/hosts and revisit as a vhost.

code

01curl -k --resolve app.internal.htb:443:$ip https://app.internal.htb/

code

01testssl.sh --severity HIGH $ip:443

Look for Heartbleed (CVE-2014-0160), expired cert, RC4/DES, weak DH, self-signed internal CA (leaks internal domain).

code

01ffuf -w subs.txt -u https://$ip/ -H "Host: FUZZ.$domain" -fs $baseline -k
02feroxbuster -u https://$ip/ -k -x php,asp,aspx,txt,html

See Web Applications → Checklist.