1

While scanning a host with nmap I have discovered an unusual service. The service moves to another port everytime I perform an nmap-scan or try to curl it. I have not yet found any info about similar cases, so I am currently not sure how to move forward. Are there any ways I can try to connect to the service, without the service moving to another port?

4
  • Use a script and curl to connect to every port.
    – ThoriumBR
    Nov 5 '20 at 22:18
  • @ThoriumBR I forgot to mention that I have already made such a script. The script returns an empty header and body when it reaches the port the service is running on.
    – sveggen
    Nov 5 '20 at 22:40
  • So how you are sure there's a service there?
    – ThoriumBR
    Nov 5 '20 at 23:25
  • @ThoriumBR I am not, I just assumed it as the port was open.
    – sveggen
    Nov 8 '20 at 20:04
1

This sounds like port knocking. Port knocking is where you connect to a sequence of ports before a port is exposed that allows you to connect to a specific service.

Some people like to use it as an extra security measure to lockdown SSH.

For example lets say I've configured my server to listen on port TCP/1111, then when someone connects to TCP/1111 it will open TCP/2222 and so on until finally port TCP/22 opens and I can SSH to my device.

You can read more about how this works in the below link.

https://www.howtogeek.com/442733/how-to-use-port-knocking-on-linux-and-why-you-shouldnt/

1
  • I forgot to mention that there is no pattern in which ports that turns open, which as per my understanding is required for port knocking. Everytime I perform an nmap scan or connect to an open port a completely random port opens up. Could this still be port knocking?
    – sveggen
    Nov 12 '20 at 12:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.