Skip mismatched protocol/port probes for well-known ports

bbot/modules/http.py

@@ -81,10 +81,16 @@ def make_url_metadata(self, event):
                 url_hash = hash((event.host, event.port, has_spider_max))
             urls = [url]
         else:
-            # OPEN_TCP_PORT — probe both http and https
+            # OPEN_TCP_PORT — probe both http and https (but skip mismatched well-known ports)
             host = event.host
             port = event.port
-            urls = [f"http://{host}:{port}/", f"https://{host}:{port}/"]
+            netloc = self.helpers.make_netloc(host, port)
+            if port == 443:
+                urls = [f"https://{netloc}/"]
+            elif port == 80:
+                urls = [f"http://{netloc}/"]
+            else:
+                urls = [f"http://{netloc}/", f"https://{netloc}/"]
             url_hash = hash((host, port, has_spider_max))
         if url_hash is None:
             url_hash = hash((urls[0], has_spider_max))

bbot/test/test_step_2/module_tests/test_module_http.py

@@ -211,6 +211,45 @@ def check(self, module_test, events):
         )
 
 
+class TestHTTP_url_metadata(ModuleTestBase):
+    """White-box test of make_url_metadata's OPEN_TCP_PORT probe set.
+
+    Well-known ports only probe their matching scheme (443→https, 80→http);
+    every other port probes both. url_hash stays scheme-independent so incoming
+    dedup is unaffected, and IPv6 hosts get bracketed netlocs.
+    """
+
+    targets = ["http://127.0.0.1:8888"]
+    module_name = "http"
+    modules_overrides = ["http"]
+
+    def check(self, module_test, events):
+        module = module_test.module
+        make_event = module_test.scan.make_event
+
+        e443 = make_event("127.0.0.1:443", "OPEN_TCP_PORT", dummy=True)
+        urls, url_hash = module.make_url_metadata(e443)
+        assert urls == ["https://127.0.0.1:443/"], "port 443 should probe https only"
+        # url_hash is scheme-independent, so OPEN_TCP_PORT dedup is unaffected
+        assert url_hash == hash((e443.host, e443.port, False))
+
+        e80 = make_event("127.0.0.1:80", "OPEN_TCP_PORT", dummy=True)
+        urls, _ = module.make_url_metadata(e80)
+        assert urls == ["http://127.0.0.1:80/"], "port 80 should probe http only"
+
+        e8080 = make_event("127.0.0.1:8080", "OPEN_TCP_PORT", dummy=True)
+        urls, _ = module.make_url_metadata(e8080)
+        assert urls == ["http://127.0.0.1:8080/", "https://127.0.0.1:8080/"], (
+            "non-well-known ports should probe both schemes"
+        )
+
+        e6 = make_event("[dead::beef]:8080", "OPEN_TCP_PORT", dummy=True)
+        urls, _ = module.make_url_metadata(e6)
+        assert urls == ["http://[dead::beef]:8080/", "https://[dead::beef]:8080/"], (
+            "IPv6 hosts should produce bracketed netlocs"
+        )
+
+
 class TestHTTP_429_max_retries(ModuleTestBase):
     targets = ["http://127.0.0.1:8888"]
     modules_overrides = ["http"]