1

I'm using Compute Engine on GCP. I installed ubuntu + apache (including ModSecurity). We used third party to do penetration testing and they can successfully doing remote connection through port 9090 and get server access through /bin/bash. Illustration is attached below.

I'm a bit confused because port 9090 is closed on Compute Engine Firewall. I used Mac Port Scanner port 9090 is closed as well. Is there any easy way / prove that port 9090 in my Compute Engine is opened?

penetration testing illustration

Improve this question
5
  • 2
    The image says "Connection from [127.0.0.1]" I don't think the pen testers connected from the internet on port 9090. And is 'arca@xterm' the local console of the pen tester or is the console of your server?
    – Augusto
    Commented Jul 5, 2019 at 4:32
  • It's the local console of the pen tester. I didn't give the authentication information of my server to pen testers.
    – Eldwin Eldwin
    Commented Jul 5, 2019 at 4:42
  • Open port test ?
    – Overmind
    Commented Jul 5, 2019 at 6:04
  • There's significant bits of information missing; as @Augusto said, the connection comes from a loopback device, so there must be more to it than you say - or it's fake.
    – Tobi Nary
    Commented Jul 5, 2019 at 6:36
  • 2
    If these are your pen testers and you don't understand the report they've provided, you should go back to them and ask them to help clarify it for you. They should be able to tell you exactly what the problem is, and if they're good, give you advice on how to remediate it. Here, you're only going to get wild guesses.
    – Xander
    Commented Jul 5, 2019 at 13:04

0

Reset to default

Browse other questions tagged .