When doing an Nmap scan from an external network, what open ports should be an instant red flag?
For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other open ports should I be on the lookout for?
-
4In my opinion there are no red flags. Every open port might be open for a reason, there is nothing wrong with a port being open if the service related with it is correctly configured and secured. It's more about services running on each port.– game0verCommented Jul 21, 2018 at 14:03
Add a comment
|
3 Answers
To echo gameOver's comment and elaborate further, simply detecting that a port is open is interesting but I wouldn't see it as an immediate 'red flag'. Perhaps a better approach might be to run Nmap with the -sV or -sC flags which will either run a service/version scan or launch the default NSE (Nmap Scripting Engine) scripts against the target port that you've deemed interesting, provided you have the proper authorization to do so.
So, for example let's say you discovered that port 21 is open, which is interesting, but it only becomes a potential attack vector when you can enumerate the service running behind it. Once you discover the specific service you can begin searching CVEs and gain a better understanding if there is a vulnerability tied to it. By running a script-scan, the NSE will test your specific port in question and will output its findings, this might include (for port 21) an anonymous FTP login misconfiguration that allows for read/write access.
Now, after further enumeration of the service running behind port 21, you have a potential attack vector.
As a final note, there are some known ports where specific types of malware have a history of using, but these can also be false positives as I could simply run my SSH client out of TCP port 31337. You might see this port as open and immediately think Back Orifice! Instead I'm just running SSH using an unusual port to do so.
Sources:
answered Jul 21, 2018 at 17:27
-
Worth noting here is that plenty of kinds of software pick ports randomly. That's an easy way for any port that might be often used by, say, malware, to be used by a legitimate program instead. Mind you, there is a little over 48,000 ports that are meant for normal use and don't require admin access to use, so a random port getting a specific, suspicious port is kinda unlikely. But for example, my company's software can easily open a few dozen ports for log servers, lightweight license servers, and RPC between multiple applications.– KatCommented Jul 24, 2018 at 19:47
-
@waymobetta I'm not against this response as it is insightful, but you don't really list any red flags or signatures of vulnerabilities that can be looked for except 21/FTP. Automating nmap scan reports to highlight commonly attack vectors is completely legitimate. I link to SANS storm center in the answer below. Commented Jul 26, 2018 at 19:59
-
3Well that wasn't really the intention of the post. I alluded to how vulnerabilities can be discovered only after enumeration, and provided the simple FTP misconfig scenario that might prompt escalating the initial assessment of a discovered, open port from 'interesting' to 'red flag' considering what can be done with public read/write access found only after determining and interacting with the running FTP service. This was only meant to be an example rather than a comprehensive listing of all ports and the vulnerabilities associated with their respective services. Commented Jul 26, 2018 at 20:44
Just because a port exists in a scan is not enough to raise a red flag.
- Some firewalls or other protection mechanisms (honeypots) will make it look like a port is up when it is not
- Not all ports run the services that are typical
- Any port that might look suspicious on one network might be locked down properly on another
- You should be investigating all ports that pop up in a scan anyway, so it really doesn't matter what pops up
The point is that you should have a methodical process to address all ports with as much vigour as the rest, so getting excited about one port, in particular, is not very helpful.
answered Jul 21, 2018 at 20:59
-
6Except for telnet. If I see telnet, I hit that port first above all else.– schroeder ♦Commented Jul 21, 2018 at 21:00
-
Your answer isn't inline with the question. He's asking about red flags from nmap scans, not an education on how ports work. I'm assuming he is aware of that and wants to know if any services are particularly exploitable. Nmap -A will banner grab and confirm if the service is accessible so most of this is pretty moot exept the honeypot, which is uncommon and doesn't invalidate the question. You also contradict yourself in with your comment on telnet. Commented Jul 26, 2018 at 19:56
-
1@bashCypher which is why I added it as a humorous comment and not part of the question. If, as you assert, the question is about exploitable services then the OP needs an education on how ports work. I do not give an education on how ports work, but offer a methodology.You appear to be trying to read a lot into the question.– schroeder ♦Commented Jul 26, 2018 at 19:59
-
you're saying that port 21,22,23 is open on an external scan and you'll just ignore it because could be https running there? I don't agree. Asking for commonly dangerous ports to recognize and then do further investigation doesn't require a lesson on how ports work Commented Jul 26, 2018 at 20:01
-
Let me take a stab at answering the intention of your question. If the intention of your question is:
If I discover open ports with an external scan, assuming it has the typical associated service with it, what should be my highest priority to investigate and/or address?
Lets start with actual, live data. Here is a link to the SANS storm center https://isc.sans.edu/dashboard.html
One of those is attack traffic by port. So that is live confirmation of hackers going after those ports/services right now. I would say that should be taken very seriously. You'll notice 21/22/23 tops the list.
Also when enumerating an NMAP scan it's good to also look at what the host is. Make sure to check the "best guest at OS." If it's clearly a web camera, I would say that is much higher risk than a windows 10 machine. Might not be, but "in the wild" Web Camera's exposed to the internet are famous for getting "owned." Multi-Function devices (like a corp printer) are also famous for this.
https://www.shodan.io/search?query=basic+realm%3D%22camera%22+NOT+401
Also, what is on this network? That will affect this answer too. Is it a home network? If so, there probably shouldn't be anything exposed. Typically home devices act as clients and don't require any inbound connections to be requested. So in that case seeing any open port is concerning.
Also a very high port can be concerning as it might be a backdoor. Hackers will try to hide them by making them something like port 50505, which would be caught with a full nmap scan, which mostly not done because of how long that takes. These ports are called "ephemeral" ports and they can be used by many services that require more than one port, like a load balancer for example.
