Operating System: Windows Server 2008
.
Description: - We have a web project which is running on HTTPS PORT 443 on WWW and deployed on JBoss Application Server on Windows Operating System. Recently we received an attack on HTTP Port 80 on application server file.
.
Attempt: - We scanned application server and were able to identified API which can be executed by an attacker. We have handled this situation.
.
Problem Description: - On asking with IT team, why have they opened HTTP Port 80 on the machine? What is the need to open HTTP port, if the project is running on HTTPS PORT 443? They said that it is open because if customer access http://www.abc.com, so they will automatically transfer it to https://www.abc.com
And if they will close the PORT 80, then following request "http://www.abc.com" cannot be received.
.
Kindly let us know, how can we deal with this situation? We want some solution so that we can close the HTTP port on the machine but if a request comes to HTTP, we can automatically forward it to https.
.
Kindly assist us, I will be really thankful for any suggestion.
Regards, S.P Singh