Update redoc_exposed.md

Author: HamzaSahin61

documentation/modules/auxiliary/scanner/http/redoc_exposed.md

@@ -1,39 +1,34 @@
-## Summary
-This module detects publicly exposed **ReDoc** API documentation pages.  
-It performs safe, read-only HTTP GET requests and reports likely ReDoc instances based on common HTML markers.
+## ReDoc API Docs UI Exposed
 
-## Module name
-`auxiliary/scanner/http/redoc_exposed`
+Detects publicly exposed ReDoc API documentation pages by looking for known DOM elements, script names, and titles. The module is read-only and makes safe GET requests.
 
-## Options
-* **RPORT** – Target TCP port (default: 80)  
-* **SSL** – Enable TLS (default: false)  
-* **REDOC_PATHS** – Optional comma-separated list of paths to probe. When unset, the module probes: `/redoc, /redoc/, /docs, /api/docs, /openapi`.
+### Module Options
 
-## Verification steps
-1. Start `msfconsole`  
-2. `use auxiliary/scanner/http/redoc_exposed`  
-3. `set RHOSTS <target or file:/path/to/targets.txt>`  
-4. (Optional) `set REDOC_PATHS /redoc,/docs`  
-5. (Optional) `set RPORT <port>` and/or `set SSL true`  
-6. `run`
-
-### Expected
+* **RHOSTS** (required): Target address range or CIDR identifier.
+* **RPORT**: Default `80` (overridable via `DefaultOptions` or at runtime).
+* **SSL**: HTTPS support is registered by default (set if needed).
+* **REDOC_PATHS**: Comma-separated custom paths to probe. If unset, defaults to:
+  `/redoc,/redoc/,/docs,/api/docs,/openapi`.
 
-`[+] <ip> - ReDoc likely exposed at <path>`
+### Verification Steps
 
-### Scanning notes
-- DOM-driven checks via `get_html_document`:
-  - `<redoc>` / `redoc-` custom elements
-  - `#redoc` container
-  - `<script src="...redoc(.standalone).js">`
-- Falls back to body/title heuristics if DOM parsing is unavailable.
-- No intrusive actions; **read-only** HTTP GET requests only.
-
-### Example session
+1. Start `msfconsole`.
+2. `use auxiliary/scanner/http/redoc_exposed`
+3. `set RHOSTS <target-or-range>`
+4. (Optional) `set REDOC_PATHS /redoc,/docs`
+5. (Optional) `set SSL true`
+6. `run`
 
-use auxiliary/scanner/http/redoc_exposed
-set RHOSTS 127.0.0.1
-set RPORT 8001
-set SSL false
-run
+### Scenarios
+```text
+msf6 > use auxiliary/scanner/http/redoc_exposed
+msf6 auxiliary(scanner/http/redoc_exposed) > set RHOSTS 192.0.2.0/24
+msf6 auxiliary(scanner/http/redoc_exposed) > run
+[+] 192.0.2.15 - ReDoc likely exposed at /docs
+[*] 192.0.2.23 - no ReDoc found
+```
+### Notes
+
+* **Stability**: `CRASH_SAFE` (GET requests only).
+* **Reliability**: No session creation.
+* **SideEffects**: Requests may appear in server logs (`IOC_IN_LOGS` if applicable).