Tools/methods helping to determine application/protocol serving specific port

Question

I do blackbox testing of the server and figured out that there is a bunch of listening ports. I need to determine what services/protocols those ports are used for.

What I've tried so far is to use Armitage (as far as I've understood it runs some Metasploit discovery modules against commonly used ports, like port 80 for http) and it managed to determine the purpose of a couple of the open ports.

However, there are a lot of unknown ports left.

So, what more can I do to discover what applications (services/protocols) run on the rest of the ports?

Answer 1

The short answer is that you need to talk to the port to see who answers. Two things can come from this:

• banners
• protocol traffic

The problem is that banners can be faked, so you need a tool to analyze the traffic in order to get an accurate picture.

Tools:

• netcat/nc/ncat - useful for basic banner grabbing
• sbd - like nc, but encrypted - useful for basic ssl-based banner grabbing
• nmap - the king of service detection (use -sV)
• wireshark - in-depth protocol analysis with some built-in features (use when using the other tools)
• scapy - for really in-depth raw protocol analysis
• other focused tools for certain protocols like httprint

Metasploit has a long list of service scanners, but they are best to supplement a more direct service analysis. I highly recommend that you shift away from Armitage until you have more experience with the tools above and with the msfconsole. Then, Armitage can improve your productivity.

Other Methods:
The more efficient method is to ask the target operating system what it is running. If you can query SNMP, you might get a service and port list handed to you. If you have shell access, you can run commands to list running services.

Pro Tips:
Be careful that the tools you use don't simply lookup the port number in a table of common services. It is easy to run services on non-standard ports. Also, make sure you scan over the entire 65,535 port range in both TCP and UDP. Some tools, including nmap, improve performance by only checking the most common port numbers, which means they can miss common services running on non-standard ports (ssh on port 8022, for instance). Warning: UDP scans can take a very long time.

Answer 2

nmap.

nmap can test for what services are running on a particular port, using information such as packet headers returned.

nmap uses its own library of common ports and services which covers many of the most common and sometimes not so common services. Of course, there might be some services which nmap does not recognize, but you can remedy that by submitting the fingerprint information if you know the exact service.

Basic scanning techniques like the -sS option will only show what ports are open. However, nmap can discover a lot more information by specifying different flags like -sV for version scan or -sC for nmap scripting engine.