Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm working on a pen-testing project and still in the beginning but I faced a switch with only 80 & 23 ports opened. How can I use these ports to attack that switch ?

share|improve this question
1  
I honestly think you are doing your employer a disservice if you are attempting to pentest and are not sure what you are looking at before wondering what vulnerabilities it might have. TCP23 is most likely a telnet service, as it is the assigned port for that, but what kind of switch, what OS/Firmware? if you haven't been able to fingerprint or otherwise come up with the answers to this you will wast a lot of time looking through ExploitDB and other sources for vulnerabilities. You need to know what, specifically, you are looking at in order to search for known vulns. –  Rod MacPherson Jul 29 '13 at 15:21
add comment

closed as too broad by Terry Chia, NULLZ, Xander, Adnan, Lucas Kauffman Jul 28 '13 at 15:45

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

Ports do not have vulnerabilities. The services listening on the ports do.

This question is way too broad to be reasonably answered as the answers will differ on a application to application basis, as well as a version to version basis. Have a search through some of the common vulnerability and exploits databases as a starting point.

share|improve this answer
    
already did ... 80 & 23 are common ports , so are there services ... anyway , I have telnet on 23 , but nessus can't find any vulnerability . –  Emado Jul 28 '13 at 14:41
1  
The telnet service hasn't been common for 10 years. It was replaced by ssh. Port 23 is pretty much unused these days. Port 80 is still in common use (I'm using it now to post this comment) but vulnerabilities exploited over port 80 depend on the software running. IIS, Apache, nginx and Lighttpd are all examples of web servers. HAProxy, Squid and Pound are proxy servers. PHP, Perl, Python, asp, Ruby and Java are all languages used for making web applications. Without listing what's running, this question is far too broad. Maybe a question about fingerprinting those ports would be good. –  Ladadadada Jul 28 '13 at 15:42
    
thanks buddy, but in my workplace there is a telnet on 23 because "maybe" it is an internal network . I know that I have to find the listening service , but I have to ask ... WHAT kinds of services that runs on a switch ?? –  Emado Jul 28 '13 at 16:10
    
Management services are common on switches. telnet and ssh are both command line management services, HTTP and HTTPS are web-based management services. But once again, the specific application running on those ports is the most important aspect. –  Ladadadada Jul 28 '13 at 17:17
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.