From dab7b10ebe278199c5658f6fabd8abf5e5e37130 Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Thu, 2 Apr 2015 04:40:26 +0000
Subject: [PATCH] Add 3389 as an SSL port; Enhanced RDP Security requires TLS

---
 nmap-service-probes  |  1 +
 nselib/shortport.lua | 21 +++++++++++++++++----
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/nmap-service-probes b/nmap-service-probes
index c4be24785..c69456b17 100644
--- a/nmap-service-probes
+++ b/nmap-service-probes
@@ -12262,6 +12262,7 @@ match landesk-rc m|^TNMP.\0\0\0TNME.\0\0\0USER.\x07\x04\0\x08\0.{9}\0P\0\x03\0U\
 Probe TCP TerminalServer q|\x03\0\0\x0b\x06\xe0\0\0\0\0\0|
 rarity 6
 ports 515,1028,1068,1503,1720,1935,2040,3389
+sslports 3389
 
 match activefax m|^ActiveFax Server: Es befinden sich insgesamt| p/ActFax Communication ActiveFax/ i/German/
 
diff --git a/nselib/shortport.lua b/nselib/shortport.lua
index d2a263a8e..082c6dde5 100644
--- a/nselib/shortport.lua
+++ b/nselib/shortport.lua
@@ -185,12 +185,25 @@ LIKELY_HTTP_SERVICES = {
 http = port_or_service(LIKELY_HTTP_PORTS, LIKELY_HTTP_SERVICES)
 
 local LIKELY_SSL_PORTS = {
-  443, 465, 587, 636, 989, 990, 992, 993, 994, 995, 5061, 6679, 6697, 8443,
-  9001,
+  443, -- https
+  465, -- smtps
+  636, -- ldapssl
+  989, -- ftps-data
+  990, -- ftps-control
+  992, -- telnets
+  993, -- imaps
+  994, -- ircs
+  995, -- pop3s
+  3389, -- ms-wbt-server
+  5061, -- sip-tls
+  6679,
+  6697,
+  8443, -- https-alt
+  9001, -- tor-orport
 }
 local LIKELY_SSL_SERVICES = {
-  "ftps", "ftps-data", "https", "https-alt", "imaps", "ircs",
-  "ldapssl", "pop3s", "sip-tls", "smtps", "telnets", "tor-orport",
+  "ftps", "ftps-data", "ftps-control", "https", "https-alt", "imaps", "ircs",
+  "ldapssl", "ms-wbt-server", "pop3s", "sip-tls", "smtps", "telnets", "tor-orport",
 }
 
 ---