Skip to content

Fix https probe suppression on Cloudflare/CDN targets - #3143

Merged
liquidsec merged 1 commit into
devfrom
http-suppress-fix
Jun 8, 2026
Merged

Fix https probe suppression on Cloudflare/CDN targets#3143
liquidsec merged 1 commit into
devfrom
http-suppress-fix

Conversation

@liquidsec

Copy link
Copy Markdown
Collaborator

Summary

  • When probing an OPEN_TCP_PORT with both http:// and https://, the http module suppresses the https probe if http "succeeded". Previously, any non-zero HTTP status counted as success -- including 400 responses from CDNs like Cloudflare that reject plain HTTP on TLS ports.
  • This caused https probes to be silently dropped on Cloudflare-fronted targets (e.g. stackoverflow.com), meaning bbot -t stackoverflow.com would only find the http 301 redirect and never visit the actual https site.
  • Fix: only treat http 2xx as "http succeeded". 3xx (redirects), 4xx, and 5xx no longer suppress the https probe.
  • Verified with Burp proxy: the suppression still works correctly when behind an intercepting proxy (http returns 200 through the proxy, so https is suppressed as intended).

Only treat http 2xx as "http succeeded" when deciding whether to
suppress the paired https probe. Previously any non-zero status
(including 400) counted, which caused https probes to be suppressed
on targets where the CDN returns 400 for plain HTTP on port 443.
@liquidsec
liquidsec requested a review from ausmaster June 6, 2026 12:34
@github-actions

github-actions Bot commented Jun 6, 2026

Copy link
Copy Markdown
Contributor

📊 Performance Benchmark Report

Comparing dev (baseline) vs http-suppress-fix (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name 📏 Base 📏 Current 📈 Change 🎯 Status
Bloom Filter Dns Mutation Tracking Performance 4.22ms 4.25ms +0.9%
Bloom Filter Large Scale Dns Brute Force 17.94ms 17.58ms -2.0%
Large Closest Match Lookup 334.99ms 340.83ms +1.7%
Realistic Closest Match Workload 178.82ms 178.45ms -0.2%
Event Memory Medium Scan 1394 B/event 1394 B/event +0.0%
Event Memory Large Scan 1519 B/event 1519 B/event +0.0%
Event Validation Full Scan Startup Small Batch 373.89ms 378.67ms +1.3%
Event Validation Full Scan Startup Large Batch 484.11ms 512.45ms +5.9%
Make Event Autodetection Small 19.47ms 19.84ms +1.9%
Make Event Autodetection Large 199.82ms 204.51ms +2.3%
Make Event Explicit Types 8.05ms 8.30ms +3.1%
Excavate Single Thread Small 3.166s 3.169s +0.1%
Excavate Single Thread Large 8.656s 8.680s +0.3%
Excavate Parallel Tasks Small 3.338s 3.332s -0.2%
Excavate Parallel Tasks Large 5.884s 5.830s -0.9%
Intercept Throughput Small 997.45ms 991.68ms -0.6%
Intercept Throughput Medium 997.63ms 979.72ms -1.8%
Is Ip Performance 2.25ms 2.28ms +1.5%
Make Ip Type Performance 194.67µs 198.44µs +1.9%
Mixed Ip Operations 2.35ms 2.36ms +0.3%
Memory Use Web Crawl 403.7 MB 385.3 MB -4.5%
Memory Use Subdomain Enum 29.2 MB 29.2 MB +0.1%
Memory Use Deep Chain 8.5 MB 8.5 MB +0.0%
Memory Use Parallel Chains 24.6 MB 22.3 MB -9.2%
Scan Throughput 100 2.918s 2.972s +1.9%
Scan Throughput 1000 20.033s 20.203s +0.9%
Typical Queue Shuffle 5.60µs 5.44µs -2.7%
Priority Queue Shuffle 27.41µs 26.88µs -1.9%

🎯 Performance Summary

No significant performance changes detected (all changes <10%)


🐍 Python Version 3.11.15

@codecov

codecov Bot commented Jun 6, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90%. Comparing base (db3e012) to head (6ee0df3).
⚠️ Report is 6 commits behind head on dev.

Additional details and impacted files
@@          Coverage Diff          @@
##             dev   #3143   +/-   ##
=====================================
- Coverage     90%     90%   -0%     
=====================================
  Files        441     441           
  Lines      39003   39004    +1     
=====================================
- Hits       34915   34912    -3     
- Misses      4088    4092    +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@liquidsec liquidsec added bug Something isn't working high-priority labels Jun 6, 2026

@ausmaster ausmaster left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good stuff

@liquidsec
liquidsec merged commit 5726725 into dev Jun 8, 2026
20 checks passed
@liquidsec
liquidsec deleted the http-suppress-fix branch June 8, 2026 16:20
@liquidsec liquidsec mentioned this pull request Jun 9, 2026
@ausmaster ausmaster added this to the BBOT 3.0 - blazed_elijah milestone Jun 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working high-priority

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants