I scanned my friend's firewall (Zyxel SBG3500-N) with NMAP and I found some undocumented ports open with services:

8888 tcp open http syn-ack lighttpd 1.4.34

18443 tcp open http syn-ack lighttpd 1.4.34

I could not find any info why those should be open and browser just returns 404 - Not Found error. How could I investigate more those ports? Do you know any suitable fuzzing tool for this purpose?

  • 1
    Did you scan it from inside or outside the network? – A. Darwin Oct 1 '16 at 12:48
  • Ask your friend if he set up port forwarding – schroeder Oct 1 '16 at 12:57
  • It was scanned inside and no port forwarding. – V.Hedman Oct 2 '16 at 8:05
  • I was able to do some fuzzing with OWASP ZAP and their basic files, but with no info. – V.Hedman Oct 2 '16 at 8:06

This is something used by routers: 'lighttpd'

A user can enable this in the router configuration page and add files to a designated folder or folders (likely the ones you were able to find). There they can store the files to run a simple webpage which can be accessed remotely just like any other website.

some info here: https://wiki.openwrt.org/doc/howto/http.lighttpd

| improve this answer | |

You could try SkipFish (https://code.google.com/archive/p/skipfish/)

It starts with a dictionary attack on the web server, and then combines that with a web-crawler.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.