I scanned my friend's firewall (Zyxel SBG3500-N) with NMAP and I found some undocumented ports open with services:
8888 tcp open http syn-ack lighttpd 1.4.34
18443 tcp open http syn-ack lighttpd 1.4.34
I could not find any info why those should be open and browser just returns 404 - Not Found error. How could I investigate more those ports? Do you know any suitable fuzzing tool for this purpose?