Getting varied results when -u Url is http://example.com:443 vs https://example.com:443

[croeber]

Hello,

I got a scan back from our client and I am trying to replicate the scan. I noticed that the test results is different whenever the url contains https:// vs http://. The website is running via IIS 10 and only has a https binding. Can you tell me why the test results vary so much whenever the url is http vs https?

[shekyan]

If server is not able to accept plaintext connection on port 443, which is likely the case, then results are going to be different. The program will just try to do what it was asked to. Seems like expected behaviour.

[croeber]

So for the http:// version it would seem like the service was not available but in fact the server was rejecting the connection?

[shekyan]

It says the service is not avaiable on the first screenshot, because it establishes a TCP connection, then tries to send a plaintext HTTP request to it. Service is expecting an SSL handshake on that IP on port 443, most likely