Description

This detector identifies when a web application serves content over unencrypted HTTP protocol instead of secure HTTPS. HTTP connections transmit data in plain text, making it vulnerable to eavesdropping, man-in-the-middle attacks, and data tampering by malicious actors who can intercept network traffic.

Detection Strategy

• A vulnerability is reported when the target URL uses the HTTP protocol (scheme is 'http://')

• The detector triggers for any HTTP request made to the web application

• No additional conditions are required - simply accessing content over HTTP is sufficient to flag this security issue