Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for a list of ports sorted according to the number of vulnerability you can find for that specific port (considering of course, the service installed in the default port).

Example: suppose that in this years we had 800 vuln in port 80 (30 apache, 30 iis, 20 nginx) than in this list we can have:

80 800

21 400

22 30

and so on..

I don't care about the different kind of vulnerabilities, but i just need the number

share|improve this question

closed as too broad by Lucas Kauffman, GdD, Iszi, Adnan, Rory Alsop Nov 20 '13 at 16:29

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
The question is clear and it's not too broad. It just requires a lot of Googling effort and some scripting to aggregate the data. This is not the right place to ask such a question. In fact, I don't think this fits any site on the SE network. –  Adnan Nov 20 '13 at 16:27
    
How would you correlate port 80 with port 443, 8080, 8081, etc? Are they different vulnerabilities or the same one? Do you need service or application-level vulnerabilities? Does XSS count as a port 80 vulnerability? You need narrow this down a lot more before we can attempt to answer this. –  schroeder Nov 20 '13 at 17:35

2 Answers 2

There can be no such list, because vulnerabilities don't exist on ports - they exist in services. While services may normally run on a certain port, there's nothing to prevent someone from e.g.: running a web server (normally port 80) on port 23 (normally used for Telnet), hosting their IRC service (normally port 194) on port 161 (normally SNMP), or setting their Windows Terminal Services (a.k.a. RDP - usually on 3389) host to port 56729 (an uncommon port, not generally used for servers).

Even trying to build a count of vulnerabilities per service is inaccurate, because services are provided by applications and multiple applications are capable of providing a given service. For example, an Apache server will have different vulnerabilities from an IIS server even though they're both providing the same service - HTTP.

The hole just goes deeper and deeper, depending on how the applications are built or what plug-ins or other applications are running on top of them.

For a real vulnerability assessment, you need to look at your system and check the OS and applications against a database of known vulnerabilities (e.g.: OSVDB or NIST NVD). If you're looking to figure out which services you need to disable or block due to high vulnerability, don't. Simply disable/block all which are not essential to your operations, and keep those which are patched and up to date.

share|improve this answer
    
I don't need a VA at all! I need to answer to this question: "Given an open port, where we know that STATISTICALLY runs some services (cause that port is the default port for some services), how many vulnerability has been found in the past years (1-3-5 years)?" And of course, i'm not talking about CMS or app inside app. I just need to stop to the first layer of "abstraction", that is "all the application that offer certain service" (like apache+iis+ngx) As far as now the best answer is the one of Adnan where he say that i need to do a lot of scripting to put together data :) –  Alessandro 'Scinawa' Antani Nov 21 '13 at 16:16

This is not answerable. Ports are not related to vulnerabilities, services are. Depending on the type of service you would need to compile a list of all software platforms that run on part 80. Then you need to make another list of platforms that could run on top of that platform.

For instance: Apache is running on port 80 with a vulnerable CMS running on top of the webserver. Both the Apache as the CMS can have multiple vulnerabilities, so these could be accumulated.

As you can see this not really practical as I could switch the Apache to serve on port 9999 as well. This would then mean that all vulnerabilities are also available on port 9999. Therefore it is not really possible to compile a list.

Even when you would take into account default ports it would become difficult. What if the CMS has plugins and those plugins are vulnerable? Then you would need to add the vulnerabilities of the plugins to that particular port. But the site is server both on port 443 and 80, so that's on both ports the same amount of vulnerabilities.

The closest you could get is having a look at the nmap top-ports list which gives you an idea of the top most used ports. You could then try to correlate the amount of different platforms having the default port listed in this top-ports list. And even then it will be very complex to get a good approximation.

Your question's answer is simply: it's not feasible

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.