{
  "port": 5280,
  "protocol": "tcp",
  "service": "XMPP over BOSH / HTTP",
  "oneLiner": "An XMPP server's HTTP side — BOSH and WebSocket endpoints for browser-based chat clients.",
  "whatItIs": "Registered with IANA in 2009 as xmpp-bosh, this is the HTTP port for Bidirectional-streams Over Synchronous HTTP (XEP-0124), which tunnels an XMPP session through long-polling HTTP requests for clients that cannot hold a raw TCP stream. Prosody uses 5280 as its default plain-HTTP port, serving /http-bind for BOSH and /xmpp-websocket, with 5281 as the HTTPS counterpart. On a scan it responds like a small web server, which is exactly what it is.",
  "exposure": {
    "verdict": "careful",
    "note": "Plain HTTP by default — session credentials and messages are cleartext unless you front it with TLS on 5281 or a reverse proxy."
  },
  "checkCommand": "curl -sS -o /dev/null -w '%{http_code}\\n' http://TARGET:5280/http-bind/",
  "links": [
    {
      "title": "XEP-0124 — Bidirectional-streams Over Synchronous HTTP (BOSH)",
      "url": "https://xmpp.org/extensions/xep-0124.html",
      "kind": "spec"
    },
    {
      "title": "Prosody — setting up BOSH",
      "url": "https://prosody.im/doc/setting_up_bosh",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 5280 (xmpp-bosh)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5280",
      "kind": "iana"
    }
  ]
}