Purely for research purposes used nmap to check security of my application deployed to Firebase. However, there some questions which I can't understand:
- Why Firebase has open so many ports? Something like few hundreds.
- Almost on every port I'm getting an error
auth-owners: ERROR: Script execution failedwithout any information about it. Why is that? The only one which gives some information are the following ports: 80, 443, 5269, and 65389.
- Is TCP Sequence Prediction difficulty=17 and Network Distance 2 hops a good or bad result?
- What means ssl-date: TLS randomness does not represent time?
- What means IP ID Sequence Generation: Incremental?
- What are Aggressive OS guesses?
- I could see the open few hundreds of ports only after first scan, later on couldn't replicate this. Is it possible that Firebase/Google closed the ports or blocked me for some of them? In second scan and every other I could see only information about open ports 80, and 443 with a log "Not shown: 998 filtered ports".
- I did test this on Kali Linux using VirtualBox. In the nmap output I can see Running: Oracle Virtualbox, OS CPE: cpe:/o:oracle:virtualbox, OS details: Oracle Virtualbox, is it about my system or the scanned website hsoted on Firebase?
Even answers for some of this questions would be already really appreciated!
Edit: I did use the following command
nmap -v -A MYAPP.firebaseapp.com (for the first time and later on), also once tried
nmap -v -A -sS MYAPP.firebaseapp.com, which gave the same results as second and each next
nmap -v -A MYAPP.firebaseapp.com. Only
nmap -v -A MYAPP.firebaseapp.com gave at the beginning a different output, i.e. few hundreds of open ports.
db_nmap -v -sV MYAPP.firebaseapp.com was able to see the few hundreds (more precisely 1000) open ports doing one-by-one from Metasplot Framework's terminal. So there was no block. The command
nmap -v -A MYAPP.firebaseapp.com also works now one-by-one. Don't know what was the problem.