Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm looking for a list of ports sorted according to the number of vulnerability you can find for that specific port (considering of course, the service installed in the default port).
Example: suppose that in this years we had 800 vuln in port 80 (30 apache, 30 iis, 20 nginx) than in this list we can have:
80 800
21 400
22 30
and so on..
I don't care about the different kind of vulnerabilities, but i just need the number
There can be no such list, because vulnerabilities don't exist on ports - they exist in services. While services may normally run on a certain port, there's nothing to prevent someone from e.g.: running a web server (normally port 80) on port 23 (normally used for Telnet), hosting their IRC service (normally port 194) on port 161 (normally SNMP), or setting their Windows Terminal Services (a.k.a. RDP - usually on 3389) host to port 56729 (an uncommon port, not generally used for servers).
Even trying to build a count of vulnerabilities per service is inaccurate, because services are provided by applications and multiple applications are capable of providing a given service. For example, an Apache server will have different vulnerabilities from an IIS server even though they're both providing the same service - HTTP.
The hole just goes deeper and deeper, depending on how the applications are built or what plug-ins or other applications are running on top of them.
For a real vulnerability assessment, you need to look at your system and check the OS and applications against a database of known vulnerabilities (e.g.: OSVDB or NIST NVD). If you're looking to figure out which services you need to disable or block due to high vulnerability, don't. Simply disable/block all which are not essential to your operations, and keep those which are patched and up to date.
This is not answerable. Ports are not related to vulnerabilities, services are. Depending on the type of service you would need to compile a list of all software platforms that run on part 80. Then you need to make another list of platforms that could run on top of that platform.
For instance: Apache is running on port 80 with a vulnerable CMS running on top of the webserver. Both the Apache as the CMS can have multiple vulnerabilities, so these could be accumulated.
As you can see this not really practical as I could switch the Apache to serve on port 9999 as well. This would then mean that all vulnerabilities are also available on port 9999. Therefore it is not really possible to compile a list.
Even when you would take into account default ports it would become difficult. What if the CMS has plugins and those plugins are vulnerable? Then you would need to add the vulnerabilities of the plugins to that particular port. But the site is server both on port 443 and 80, so that's on both ports the same amount of vulnerabilities.
The closest you could get is having a look at the nmap top-ports list which gives you an idea of the top most used ports. You could then try to correlate the amount of different platforms having the default port listed in this top-ports list. And even then it will be very complex to get a good approximation.
Your question's answer is simply: it's not feasible
