When doing an Nmap scan from an external network, what open ports should be an instant red flag?
For example, if I was in the open internet and scanned www.somewebsite.com, besides
port 22, what other open ports should I be on the lookout for?
To echo gameOver's comment and elaborate further, simply detecting that a port is open is interesting but I wouldn't see it as an immediate 'red flag'. Perhaps a better approach might be to run Nmap with the
-sC flags which will either run a service/version scan or launch the default NSE (Nmap Scripting Engine) scripts against the target port that you've deemed interesting, provided you have the proper authorization to do so.
So, for example let's say you discovered that port 21 is open, which is interesting, but it only becomes a potential attack vector when you can enumerate the service running behind it. Once you discover the specific service you can begin searching CVEs and gain a better understanding if there is a vulnerability tied to it. By running a script-scan, the NSE will test your specific port in question and will output its findings, this might include (for port 21) an anonymous FTP login misconfiguration that allows for read/write access.
Now, after further enumeration of the service running behind port 21, you have a potential attack vector.
As a final note, there are some known ports where specific types of malware have a history of using, but these can also be false positives as I could simply run my SSH client out of TCP port 31337. You might see this port as open and immediately think Back Orifice! Instead I'm just running SSH using an unusual port to do so.
Just because a port exists in a scan is not enough to raise a red flag.
- Some firewalls or other protection mechanisms (honeypots) will make it look like a port is up when it is not
- Not all ports run the services that are typical
- Any port that might look suspicious on one network might be locked down properly on another
- You should be investigating all ports that pop up in a scan anyway, so it really doesn't matter what pops up
The point is that you should have a methodical process to address all ports with as much vigour as the rest, so getting excited about one port, in particular, is not very helpful.
Let me take a stab at answering the intention of your question. If the intention of your question is:
If I discover open ports with an external scan, assuming it has the typical associated service with it, what should be my highest priority to investigate and/or address?
Lets start with actual, live data. Here is a link to the SANS storm center https://isc.sans.edu/dashboard.html
One of those is attack traffic by port. So that is live confirmation of hackers going after those ports/services right now. I would say that should be taken very seriously. You'll notice 21/22/23 tops the list.
Also when enumerating an NMAP scan it's good to also look at what the host is. Make sure to check the "best guest at OS." If it's clearly a web camera, I would say that is much higher risk than a windows 10 machine. Might not be, but "in the wild" Web Camera's exposed to the internet are famous for getting "owned." Multi-Function devices (like a corp printer) are also famous for this.
Also, what is on this network? That will affect this answer too. Is it a home network? If so, there probably shouldn't be anything exposed. Typically home devices act as clients and don't require any inbound connections to be requested. So in that case seeing any open port is concerning.
Also a very high port can be concerning as it might be a backdoor. Hackers will try to hide them by making them something like port 50505, which would be caught with a full nmap scan, which mostly not done because of how long that takes. These ports are called "ephemeral" ports and they can be used by many services that require more than one port, like a load balancer for example.