Is it really better to use port 80 or 443 for outgoing traffic in order to bypass user firewall?

Question

I recently created a reverse connection shell in C#. I tested it with some computers and I noticed that some computers connected back correctly and I established connection with them but another computer running Windows 7 doesn't seem to work or establish a connection back to me.

I was using port 3001 as a communication port, and I was trying to establish a reverse connection. Any help why this computer doesn't work ? Is using port 80 or 443 as a communication port will help or It is the same as the connectiion is reverse ! In other words, Is it really better to use port 80 or 443 for outgoing traffic in a reverse connection ?

Answer 1

Port 443 is for SSL. Since SSL is "opaque" to outsiders, firewalls cannot see what is going inside it, and cannot do some transparent proxying. Moreover, a lot of the Web uses port 443 (all https:// URL). Therefore, port 443 is one of the ports most likely to be open for outgoing connections, even on sites with strict rules.

Note, though, that some sites block all outgoing connections except those which go to a specific proxy. SSL cannot be proxied transparently, but it can be done explicitly (with a CONNECT call). If you want to implement a "reverse connection shell" which will work almost everywhere, then you must be able to detect and use a possible proxy for HTTPS.

Answer 2

You must also need to understand that modern day firewalls esp with built-in IDS works on the concept of protocol conformance meaning if you plan to pass apples in a box which says oranges your are likely to be caught. This is also what in some context means deep packet inspection. Once its get checked for rfc compliance then depending upon the firewall response your packet can either be alerted , dropped or put for deny.

But you can always debug c# application to see what it happens as it tries to connect back; does it receives any RST packets or the connection breaks due to some error in sockets (request handling, termination).

Answer 3

Your personal firewall, wireless router or corporate firewall is likely configured to restrict what ports you can use when establishing an outbound connection, otherwise known as egress filtering. In your situation, using ports 80 or 443 is a great idea because those are the most common ports that web servers listen on via HTTP and HTTPS respectively. Because of this, most firewalls, even in a corporate setting, will allow outbound connectivity on ports 80 and 443.