1

I can use nmap to find open ports on a specific client with following command:

nmap -sC -sV [IP]

This command only shows incoming open ports, I'm looking for a similar command to find outgoing open port. For example I want to know whether the client has web browsing access (80) or not.

I imagine there should be a way to send web server traffic to the client and analyze the response and somehow based on that you can determine if the port is open.

Please let me know if there is anyway to figure this out.

2

For example I want to know whether the host has web browsing access (80) or not.

Outgoing TCP connection (like web browsing) have a source ip and port and a destination ip and port and sequence numbers. In order to get a response from the system your scan attempt would need to match all of these parameters, i.e. you need to guess the (more or less) random port number used by the client and the destination ip the client connects to using this port number and additionally the current sequence number.

Even if you want to know if the client is connected to a specific host you need to try thousands of possible port numbers and up to 65535 sequence numbers. While you've tried this the communication has probably already moved on which means that you now have to guess a different sequence number (i.e. moving target while you shoot). I'm not saying that this is impossible, but very unlikely.

  • Thanks for your reply @Steffen, I need to edit my question to clarify that I don't want to know about a specific host, I just want to know if the client has web browsing permission. Your answer also covers another step of my question. – Akbari Oct 26 '16 at 10:08
  • @Akbari: this makes it even worse since you need to additionally guess the target hosts IP address. There is no way to just ask the client if he can do web browsing, you only could try to detect if there is a connection open and this is as hard as I've described. – Steffen Ullrich Oct 26 '16 at 10:12
  • I thought I can just send a web server response to a random port, and client's OS will respond (reject) with something meaningful. – Akbari Oct 26 '16 at 10:15
  • @Akbari think very carefully about what exactly do you mean with words "the client has web browsing permission" and that might help you find an answer. Open ports is a very clear technical concept, either there is some process that listens on that port or not; but "web browsing permissions" is much more vague - for most common ways of blocking web browsing (e.g. various firewalls) the client/OS can't know if it's blocked or not (or blocked for certain hosts and available for others) until it tries to connect. And to attempt that connection you'd generally need to control that computer first. – Peteris Oct 26 '16 at 10:42
  • 1
    @Akbari: no, it does not work like this. If your scanning packet does not match exactly the socket and socket state used by a connection to a webserver you get either nothing back or a RST. And then you don't know if you just missed the right socket or socket state or if there really is now socket open connecting to a web server. Apart from that such a socket exists only if data needs to transferred and the non-existence does not mean that the client is not able to create such a connection. – Steffen Ullrich Oct 26 '16 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.