From d52cd842a9b3ed7eddec3f61bf6edcb4df02525f Mon Sep 17 00:00:00 2001
From: Tigah <88289044+TBX3D@users.noreply.github.com>
Date: Wed, 22 Jul 2026 14:01:33 -0700
Subject: [PATCH] fix(scan): fetch wayback source over https (#351)

the wayback passive source used http while the crt.sh and certspotter
sources use https. passive results flatten straight into findings, so
an on-path attacker could tamper with the plaintext response to inject
or strip historical urls. use https to match the other two sources.

Co-authored-by: vmfunc <vmfunc.lc@gmail.com>
---
 internal/scan/passive.go      |  2 +-
 internal/scan/passive_test.go | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/internal/scan/passive.go b/internal/scan/passive.go
index 2fc1469..c7adea0 100644
--- a/internal/scan/passive.go
+++ b/internal/scan/passive.go
@@ -33,7 +33,7 @@ import (
 var (
 	crtshBaseURL       = "https://crt.sh/?q=%%25.%s&output=json"
 	certspotterBaseURL = "https://api.certspotter.com/v1/issuances?domain=%s&include_subdomains=true&expand=dns_names"
-	waybackBaseURL     = "http://web.archive.org/cdx/search/cdx?url=*.%s/*&output=text&fl=original&collapse=urlkey"
+	waybackBaseURL     = "https://web.archive.org/cdx/search/cdx?url=*.%s/*&output=text&fl=original&collapse=urlkey"
 )
 
 // cap the response we read from any one source so a hostile/huge feed can't
diff --git a/internal/scan/passive_test.go b/internal/scan/passive_test.go
index 977619b..6c69e2d 100644
--- a/internal/scan/passive_test.go
+++ b/internal/scan/passive_test.go
@@ -169,6 +169,22 @@ func TestPassive_ScopesSubdomainsToTarget(t *testing.T) {
 	}
 }
 
+func TestPassive_SourcesUseTLS(t *testing.T) {
+	// all three passive feeds must be fetched over https: an on-path attacker
+	// able to tamper with a plain-http response could inject or drop
+	// subdomains/urls in the reported results without detection.
+	sources := map[string]string{
+		"crtsh":       crtshBaseURL,
+		"certspotter": certspotterBaseURL,
+		"wayback":     waybackBaseURL,
+	}
+	for name, base := range sources {
+		if !strings.HasPrefix(base, "https://") {
+			t.Errorf("%s base url is not https: %q", name, base)
+		}
+	}
+}
+
 func TestPassive_WaybackLongLineKeepsFeed(t *testing.T) {
 	// a single archived url with a huge query string (data:/base64 blobs do
 	// occur) must not discard every other harvested url.