Repository: projectdiscovery/nuclei

Issue:
HTTP probing optimization for high ports (>1024)
This issue tracks the HTTP probing optimization proposed in PR #6538.

**Context:**
The optimization proposes to prioritize HTTP over HTTPS when probing ports >1024, based on Shodan data analysis showing that 91.1% of services on high ports use HTTP rather than HTTPS (180,978,135 HTTP vs 17,744,516 HTTPS results for ports >1024).

**Reference:**
- PR: https://github.com/projectdiscovery/nuclei/pull/6538
- Requested by: @Mzack9999

**Rationale:**
Optimizing the scheme ordering for high ports can reduce probing time and improve efficiency when scanning services on non-standard ports.

Discussion:

Solution patch:
diff --git a/pkg/utils/http_probe.go b/pkg/utils/http_probe.go
index 3cc7d5d0..785b5b4c 100644
--- a/pkg/utils/http_probe.go
+++ b/pkg/utils/http_probe.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"strconv"
 
 	"github.com/projectdiscovery/httpx/common/httpx"
 	"github.com/projectdiscovery/nuclei/v3/pkg/input/types"
@@ -26,11 +27,18 @@ var httpFirstSchemes = []string{
 
 // determineSchemeOrder for the input
 func determineSchemeOrder(input string) []string {
-	// if input has port that is commonly used for HTTP, return http then https
 	if _, port, err := net.SplitHostPort(input); err == nil {
+		// if input has port that is commonly used for HTTP, return http then https
 		if sliceutil.Contains(commonHttpPorts, port) {
 			return httpFirstSchemes
 		}
+
+		// As of 10/2025 shodan shows that ports > 1024 are more likely to expose HTTP
+		// hence we test first http then https on higher ports
+		// if input has port > 1024, return http then https
+		if port, err := strconv.Atoi(port); err == nil && port > 1024 {
+			return httpFirstSchemes
+		}
 	}
 
 	return defaultHttpSchemes



Test patch:
diff --git a/pkg/utils/http_probe_test.go b/pkg/utils/http_probe_test.go
index f000a8a8..9ee2d0df 100644
--- a/pkg/utils/http_probe_test.go
+++ b/pkg/utils/http_probe_test.go
@@ -35,3 +35,25 @@ func TestDetermineSchemeOrder(t *testing.T) {
 		})
 	}
 }
+
+func TestDetermineSchemeOrderWithHighPorts(t *testing.T) {
+	type testCase struct {
+		input    string
+		expected []string
+	}
+
+	tests := []testCase{
+		// Ports > 1024 should return http first
+		{"example.com:2048", []string{"http", "https"}},
+		{"example.com:8081", []string{"http", "https"}},
+		{"[fe80::1]:2048", []string{"http", "https"}},
+		{"[fe80::1]:12345", []string{"http", "https"}},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.input, func(t *testing.T) {
+			actual := determineSchemeOrder(tc.input)
+			require.Equal(t, tc.expected, actual)
+		})
+	}
+}