1

I've taken a pen-testing course and for the final certificate, I have to analyze a server and make a report regarding the vulnerabilities. The server does multiple functionalities, It acts as a web application server ( as I can connect through ports 80 and 8080 to access two different web applications ), as well as a database server (through the web apps I can run queries and get data that are stored on the same server). Data are fed to it through a cat5 cable and server apps are managed remotely .

After running a full Nmap I was anticipating to see some ports regarding mysql database but all I found was :

The detected ports from a full Nmap scan :

PORT     STATE SERVICE 
80/tcp   open  http        
8009/tcp open  ajp13
8080/tcp open  http-proxy
8140/tcp open  puppet
9100/tcp open  jetdirect

what I undrestood so far :

  • port 80 , 8080 are for web apps one uses Html and the other Apache Tomcat server.
  • port 8140 for managing the apps remotely (puppet)
  • port 8009 optimized version of the HTTP protocol to allow a standalone web server such as Apache to talk to Tomcat
  • port 9100 for printing device connected to the server

The server acts as a database server , because through the apps I can run queries and get data shouldn't be any open port such as mysql 3306 ? Is it possible that ther is a port but Nmap was not able to detect it? If i missundrestood something I would be thankful if anyone sheds some light on it.

Improve this question
4
  • Interesting that it has an HTTP proxy. These days, most are locked down. But it's possible you could tunnel a MySQL connection through the proxy and access the localhost database port. socat is a tool that can help with that.
    – paj28
    Jul 29, 2022 at 20:27
  • @paj28 Are HTTP proxies locked down due to security reasons or ? Could you please explain a bit more how socat can be used in that regards ?
    – Kumar
    Jul 29, 2022 at 22:11
  • Yes, due to security reasons. And no, I can't fit an socat tutorial into a comment. There's docs online
    – paj28
    Jul 30, 2022 at 9:07
  • It looks like they've made the test system easy for you by not using encryption. You state that you can run queries and get data. Capture the traffic while running queries. I suspect that you will learn interesting things such as query construction and filtering is client-side, which would allow you to completely run amuck if true. Pen-Testing requires more than simply running tools and reporting the output.
    – user10216038
    Jul 30, 2022 at 15:14

1 Answer 1

Reset to default
7

The server acts as a database server , because through the apps I can run queries and get data shouldn't be any open port such as mysql 3306

"because through the apps" is the main point - the database needs to be reachable by the apps on the server. But there is no need for the database to be accessible otherwise, specifically not from outside of the server. This can be done by listening on localhost only (127.0.0.1) or on UNIX domain sockets - both is not accessible from outside the system but accessible from inside. Even if the database server is running on a different system the access and visibility might be restricted through firewall rules to the system where the apps run on.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .