auxiliary(scanner/http/redoc_exposed): detect exposed ReDoc API docs UI

[HamzaSahin61]

Summary

This module detects publicly exposed ReDoc API documentation pages.
It performs safe, read-only HTTP GET requests and reports likely ReDoc instances based on common HTML markers.

Module name

auxiliary/scanner/http/redoc_exposed

Options

• RPORT – Target TCP port (default: 80)
• SSL – Enable TLS (default: false)
• REDOC_PATHS – Optional comma-separated list of paths to probe. When unset, the module probes: /redoc, /redoc/, /docs, /api/docs, /openapi.

Verification steps

1. Start msfconsole
2. use auxiliary/scanner/http/redoc_exposed
3. set RHOSTS <target or file:/path/to/targets.txt>
4. (Optional) set REDOC_PATHS /redoc,/docs
5. (Optional) set RPORT <port> and/or set SSL true
6. run

Expected

[+] <ip> - ReDoc likely exposed at <path>

Scanning notes

• DOM-driven checks via get_html_document:
  • <redoc> / redoc- custom elements
  • #redoc container
  • <script src="...redoc(.standalone).js">
• Falls back to body/title heuristics if DOM parsing is unavailable.
• No intrusive actions; read-only HTTP GET requests only.

Example session

use auxiliary/scanner/http/redoc_exposed
set RHOSTS 127.0.0.1
set RPORT 8001
set SSL false
run

[msutovsky-r7]

Can you add documentation for your module? Ideally, with steps to setup development environment

[github-actions]

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

• Writing Module Documentation
• Template
• Examples

[HamzaSahin61]

Thanks for the review! I’ve applied all suggestions:

• Removed require 'msf/core' and added the standard Metasploit header.
• Switched return values to true/false, removed the explicit timeout.
• Implemented DOM checks via get_html_document (<redoc>, #redoc, redoc(.standalone).js) with a lightweight fallback.
• Kept REDOC_PATHS optional with a default path list when empty.
• Added module docs at documentation/modules/auxiliary/scanner/http/redoc_exposed.md.
• Ran rubocop -a on the module (no offenses).
  Please let me know if anything else is needed. Thanks!

[smcintyre-r7]

Thanks for submitting this module!

[bwatters-r7]

@HamzaSahin61 do you have instructions for building a test target? Would something like https://redocly.com/docs/redoc/deployment/docker work?

[HamzaSahin61]

@HamzaSahin61 do you have instructions for building a test target? Would something like https://redocly.com/docs/redoc/deployment/docker work?
@bwatters-r7

Docker (Redocly):

1. echo 'openapi: 3.0.0
   info: {title: Demo, version: "1.0"}
   paths: {}' > openapi.yaml
2. docker run --rm -p 8001:80
   -v "$PWD/openapi.yaml:/usr/share/nginx/html/openapi.yaml:ro"
   -e SPEC_URL="/openapi.yaml" redocly/redoc

ReDoc is served at http://127.0.0.1:8001/

Metasploit:
use auxiliary/scanner/http/redoc_exposed
set RHOSTS 127.0.0.1
set RPORT 8001
set SSL false
set REDOC_PATHS /
run

Expected: [+] 127.0.0.1 - ReDoc likely exposed at /