auxiliary(scanner/http/redoc_exposed): detect exposed ReDoc API docs UI

[HamzaSahin61]

Summary

This module detects publicly exposed ReDoc API documentation pages.
It performs safe, read-only HTTP GET requests and reports likely ReDoc instances based on common HTML markers.

Module name

auxiliary/scanner/http/redoc_exposed

Options

• RPORT – Target TCP port (default: 80)
• SSL – Enable TLS (default: false)
• REDOC_PATHS – Optional comma-separated list of paths to probe. When unset, the module probes: /redoc, /redoc/, /docs, /api/docs, /openapi.

Verification steps

1. Start msfconsole
2. use auxiliary/scanner/http/redoc_exposed
3. set RHOSTS <target or file:/path/to/targets.txt>
4. (Optional) set REDOC_PATHS /redoc,/docs
5. (Optional) set RPORT <port> and/or set SSL true
6. run

Expected

[+] <ip> - ReDoc likely exposed at <path>

Scanning notes

• DOM-driven checks via get_html_document:
  • <redoc> / redoc- custom elements
  • #redoc container
  • <script src="...redoc(.standalone).js">
• Falls back to body/title heuristics if DOM parsing is unavailable.
• No intrusive actions; read-only HTTP GET requests only.

Example session

use auxiliary/scanner/http/redoc_exposed
set RHOSTS 127.0.0.1
set RPORT 8001
set SSL false
run

[msutovsky-r7]

Can you add documentation for your module? Ideally, with steps to setup development environment

[github-actions]

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

• Writing Module Documentation
• Template
• Examples

[HamzaSahin61]

Thanks for the review! I’ve applied all suggestions:

• Removed require 'msf/core' and added the standard Metasploit header.
• Switched return values to true/false, removed the explicit timeout.
• Implemented DOM checks via get_html_document (<redoc>, #redoc, redoc(.standalone).js) with a lightweight fallback.
• Kept REDOC_PATHS optional with a default path list when empty.
• Added module docs at documentation/modules/auxiliary/scanner/http/redoc_exposed.md.
• Ran rubocop -a on the module (no offenses).
  Please let me know if anything else is needed. Thanks!

[smcintyre-r7]

Thanks for submitting this module!

[bwatters-r7]

@HamzaSahin61 do you have instructions for building a test target? Would something like https://redocly.com/docs/redoc/deployment/docker work?

[HamzaSahin61]

@HamzaSahin61 do you have instructions for building a test target? Would something like https://redocly.com/docs/redoc/deployment/docker work?
@bwatters-r7

Docker (Redocly):

1. echo 'openapi: 3.0.0
   info: {title: Demo, version: "1.0"}
   paths: {}' > openapi.yaml
2. docker run --rm -p 8001:80
   -v "$PWD/openapi.yaml:/usr/share/nginx/html/openapi.yaml:ro"
   -e SPEC_URL="/openapi.yaml" redocly/redoc

ReDoc is served at http://127.0.0.1:8001/

Metasploit:
use auxiliary/scanner/http/redoc_exposed
set RHOSTS 127.0.0.1
set RPORT 8001
set SSL false
set REDOC_PATHS /
run

Expected: [+] 127.0.0.1 - ReDoc likely exposed at /

[bwatters-r7]

msf auxiliary(scanner/http/redoc_exposed) > show options

Module options (auxiliary/scanner/http/redoc_exposed):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   Proxies                       no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: socks4,
                                            socks5, socks5h, http, sapni
   REDOC_PATHS  /                yes       Comma-separated list of paths to probe
   RHOSTS       10.5.135.119     yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-m
                                           etasploit.html
   RPORT        8001             yes       The target port (TCP)
   SSL          false            no        Negotiate SSL/TLS for outgoing connections
   THREADS      1                yes       The number of concurrent threads (max one per host)
   VHOST                         no        HTTP server virtual host


View the full module info with the info, or info -d command.

msf auxiliary(scanner/http/redoc_exposed) > run
[+] 10.5.135.119 - ReDoc likely exposed at /
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/http/redoc_exposed) > 

[bwatters-r7]

Noticed my suggestion had a duplicate section. Sorry about that!

[HamzaSahin61]

Noticed my suggestion had a duplicate section. Sorry about that!

not problem :) fixed it.

Requested changes were addressed

[bwatters-r7]

Release Notes

Adds a module to detect publicly exposed ReDoc API documentation pages using read-only HTTP GET requests searching for common HTML markers.

[bwatters-r7]

Thank you for your module, @HamzaSahin61; I noticed that this was your first PR with us, and we appreciate it!

[HamzaSahin61]

Thank you for your module, @HamzaSahin61; I noticed that this was your first PR with us, and we appreciate it!

tnx a lot