8

I am new to the security field and reading about how to check if an application is secure. One of the checks involves finding out if the app uses non-standard security ports and protocols. However, there are thousands of ports and quite a few protocols to look at.

  • What constitutes non-standard ports and protocols?
  • What are some port and protocols that should immediately raise red flags?
Improve this question
2
  • 1
    What are "security ports"? And this "check" for them, does it say standard is good or bad? ... Asking because I wouldn't ever decide on a port number if something is secure or not. Sounds like someone just wants a easy way to earn money by selling nonsense infos/services.
    – user155462
    May 9, 2018 at 13:58
  • 10
    Since you're a newbie, I'd really try to steer you away from the idea that security is just a series of checklists. i.e. we can just have a nice list of things to avoid that we got from an official publication somewhere, and just call it a day. Your question sounds like it comes from a source that has this checklist mentality. Security is about knowledge of the specifics of your situation, not general cases.
    – Steve Sether
    May 9, 2018 at 17:22

1 Answer 1

Reset to default
19

A non-standard port just means a service running on a port other than its default, usually as defined by the IANA port numbers registry.

Running a service on a non-standard port doesn't really mean anything for security. It may reduce the amount of noise that a defender has to deal with in terms of automated scanning on the internet, where bots usually target common standard ports for vulnerabilities. Moving SSH from 22 to, for example, 55522 might reduce the number of drive-by brute-force attempts.

In order to find all services running on a system, one can use nmap or a similar tool. Here's an example command:

nmap -sS -A -Pn -T4 -p1-65535 <host>

Let's break these flags down:

  • -sS tells nmap to perform a TCP SYN scan.
  • -A enables a range of options related to OS detection, service detection, and script scanning. This is particularly important for identifying services on non-standard ports, as it actually talks to each open port to work out what the service is, rather than guessing based on the port number.
  • -Pn tells nmap not to use ICMP ping to check if the host is up. If the target blocks ICMP requests, this will result in nmap assuming that the host is down.
  • -T4 sets the speed of the scan. Valid arguments are 0 to 5. There's no reason to use anything but 4 here in my experience - anything less is just slower, and 5 reduces the accuracy of the scan because it doesn't wait long enough for TCP ACK replies.
  • -p1-65535 sets the port range. As we're hunting down both standard and non-standard ports, this is the only way to cover everything. You can also use -p- as shorthand for this.

The results of this command should show you any ports that are open and what services are running on them. From there it's an open question as to what protocols are considered a potential avenue of attack. SSH or Telnet might be useful, but unless they use a weak username and password it's probably not interesting. They might run a HTTP server on a non-standard port, with a vulnerable web application being served, and that might be of interest too. The possibilities are endless.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .