Questions tagged [ports]
In computer networking a port is a software construct serving as a communications endpoint in a computer's host OS.
2
votes
3answers
98 views
2 vs 3 tier network architecture
I am interested in how a 3-tier network topology (web/app/data) provides improved security than a 2-tier topology (web-app/data). I understand the concept of a DMZ as the initial contact point with ...
0
votes
1answer
69 views
Is there a software that would scan the ports automatically, then predict if there are any malicious activity going on, on my Win10 PC? [closed]
I've got this malware(or spyware as Kaspersky detected), from the USB storage device by purely a lack of focus. After scanning and defecting all the drives that are connected to my computer with ...
-1
votes
1answer
67 views
How to find out which application runs behind port 31337?
I found an open port on a "Kartina Quattro" (https://www.kartina.tv/article/247-kartina-quattro). It's a device for watching russian TV channels.
The port number is 31337 and the Service is called ...
3
votes
1answer
412 views
Ports Showing Closed/Filtered in Nmap Scans
hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other ...
0
votes
1answer
86 views
Detecting port scanning activity of a mobile app
I highly suspect that one of my iPhone apps is scanning for open ports on the local network, but can't think of a way to detect such activity.
I know that I can monitor http(s) connections by using ...
0
votes
2answers
104 views
Open ports on my NetGear router
I ran an nmap scan on my home router and I am seeing a ton of open ports. Is this normal? How do I go about closing them?
$ nmap 192.168.1.1
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-16 20:...
1
vote
0answers
26 views
Nmap showing different open ports every few seconds [duplicate]
I'm running Nmap on an Amazon Web Services EC2 instance but between runs just a couple seconds apart, I'm getting new results. Is this normal? I'm seeing open ports then they don't show.
I'm running ...
0
votes
2answers
105 views
Does having Frontend and Backend on the same port any consequences?
I am currently working on a mean application, with an Angular frontend and an express/node backend. Frontend and backend communicate together with a REST API.
When I deploy the application, both the ...
1
vote
1answer
62 views
Determine victim of port scan's OS
I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are ...
0
votes
2answers
161 views
Do I lose the anonymity of a VPN if they open a port for me?
I currently use a VPN supplier that does not allow for opening ports. They argue that I lose the whole point of a VPN and the anonymity by doing this. I can't see how and they don't seem to be able to ...
-1
votes
1answer
142 views
0
votes
0answers
24 views
Finding how many filtered ports of a host that would be listed as “filtered” on Nmap
I just started working on nmap and was confused by this question. I'm unsure if I understood it correctly, so I appreciate your help with this.
Using Nmap, find how many ports are filtered in testphp....
1
vote
1answer
90 views
What ports are okay to be open on a macbook pro?
When I do a network scan for open ports on my MacBook Pro, I can see the following open TCP ports below. Are these 'standard' open port for a personal computer of this type? Should I be concerned? ...
4
votes
2answers
286 views
Is is bad practice to use non-standard ports? (for example ssh from 22 to something different)
Background is that I am learning some technical stuff with the Enki App. In this case about security. The App states that it is a misuse of a port if I change for example the ssh port from 22 to ...
1
vote
2answers
110 views
Should ports be visible to nmap?
I'm currently working on the firewall when I discovered that the firewall exposes a lot of ports outside of the internal network. I discovered this when setting up a new FTP server using a basic nmap ...
2
votes
1answer
57 views
Is it safe to have port 443 unprotected by firewall without application?
Say I have a website, http://www.mostlysecuresite.com, which runs on a server at my house. Let's say I wanted to get an SSL cert in a few weeks. Because of this, I had my Port 443 forwarded on my ...
45
votes
5answers
14k views
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
I often establish Ubuntu-LAMP environments on which I host a few Drupal web applications that I myself own (I don't provide any hosting services and never done so in the past).
Whenever I establish ...
1
vote
2answers
92 views
Port bound TLS certificates? (1 Self-signed & 1 CA)
For my android game, I want to secure the connection between the server and its clients through TLS certificates on each side, because of the sensitive data that is beeing exchanged through a token ...
1
vote
1answer
144 views
Understanding port scanning with firewall enabled
My objective is to do a port scanner in windows and find the ports which are open. Suppose, I run an application which opens up a port 8000. Now I create a new inbound rule to block all incoming ...
0
votes
2answers
317 views
Do I have to block UDP ports when I launch my own server with a public IP?
I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny".
...
1
vote
1answer
28 views
Why do processes on servers have socket types associated to the port number? [closed]
Why do some servers have TCP/UDP alongside the port they're listening to. To my understanding TCP and UDP are socket layers, they're methods of determining how the traffic is being sent over the ...
1
vote
1answer
252 views
NMAP reporting all ports open
I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between.
I tried the SYN scan, and when I check the traffic in WireShark I see ...
0
votes
3answers
203 views
Nmap scanning single port too fast? Shows as filtered?
I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with ...
-1
votes
1answer
81 views
Port knocking is authentication?
In computer networking, port knocking is a method of externally
opening ports on a firewall by generating a connection attempt on a
set of prespecified closed ports. Once a correct sequence of
...
0
votes
1answer
53 views
What is an excessive amount of SYN requests for port scanning?
I have a slow internet connection - about 12Mb/s. In 10 minutes I have detected a distributed port scan on the router from different IPs. I have counted these SYN packets at in 600 seconds (10 minutes ...
0
votes
1answer
321 views
Why adclick.g.doubleclick.net listens on all ports [closed]
I have adclick.g.doubleclick.net listening on all ports. When I launch an application like Starcraft 2, for example, it is listening on localhost. Or for some applications, there was a connection from ...
1
vote
1answer
514 views
What are the possible solution for blocking VPN connection on a home network?
I am not a techie. I am just wanting to force some parentral control using OPENDNS. Opendns works fine however it is easily broken on android or windows using vpn software like ultrasurf or latern or ...
1
vote
2answers
47 views
Is there a point to set up passwords for services like MySQL, Redis etc. if we disable their related ports?
Redis' default port is 6379 and MySQL's default port is 3306. Let's say we disable these ports to outside of the world with ufw. And let's say only I have access to the servers. Is there still a point ...
-1
votes
1answer
137 views
What ports can make me get RCE on the devices? [closed]
I know that remote code execution depends on the service running on the open port.
For example I know that SSH, FTP may be vulnerable to RCE if they are running an unpatched version.
So what about ...
-1
votes
1answer
99 views
Does Windows perform TCP and/or UDP port scans? [closed]
I want to know whether Windows Operating System does TCP/UDP port scans, and how often if it does?
Thanks for your time.
1
vote
1answer
82 views
Refusal to 'open' up corporate network?
I am working a project which requires access to a service running on a remote server, over a single TCP port (>1024). This service runs on a machine located within an existing network, and the project ...
1
vote
2answers
6k views
Can a hacker hack into port 80?
We normally say port 80 is firewall friendly.
But can a hacker just hack into port 80 via TCP or UDP?
Or is Port 80 by default not always open?
It waits for the host to initiate a connection via ...
0
votes
3answers
2k views
Port sweep vs port scan
I was asked this question in an interview:
"What is a port sweep?"
When I replied with port scan he said that my answer was not a scan, it was a port sweep. I googled and found "tcp sweep: but not "...
2
votes
1answer
134 views
Port Knock logs suggest machine has been compromised?
On my CentOS machine, all my ports are filtered with the Iptables rule:
DROP all -- * * 0.0.0.0/0 0.0.0.0/0
So from the Internet, every port timeouts.
The only way to ...
3
votes
2answers
160 views
Nmap and it default scripts when I already know some of the information
I am a network guy and not a “hacker” or whatever the official term is these days.
I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure.
The thing is ...
1
vote
2answers
467 views
Close Port 587 - Ramifications?
Our recent PCI scan failed because "Plaintext authentication is allowed over unencrypted channel on SMTP." As such, our tech support suggested to close port 587.
What are the effects of closing port ...
2
votes
0answers
715 views
Using burp suite, how can I intercept traffic from one localhost port, but not another one
I have one webapp available on localhost:12345, and another service running on `localhost:6789'. I want to monitor the traffic to/from the webapp (12345), but universally pass the traffic to the ...
0
votes
2answers
518 views
Multiple Open ports on a server, is that safe? [closed]
Using nmap I try to scan a server as a result I get multiple open ports.
For example when I try to scan domain.com as a result:
7/tcp open echo
9/tcp open discard
13/tcp open daytime
21/tcp filtered ...
7
votes
1answer
4k views
What are non-standard ports and protocols [closed]
I am new to the security field and reading about how to check if an application is secure. One of the checks involves finding out if the app uses non-standard security ports and protocols. However, ...
-4
votes
1answer
1k views
How to use beef-xss on ports other than default 3000?
I want to use BeEF-XSS Framework over WAN (for educational purposes). The only problem is that my ISP is blocking port 3000. So, after some research, I found this page that says:
However, beef-xss ...
1
vote
1answer
51 views
Opened port leads to a collection listing
I've been doing some searching on a macOS server and have noticed that there's an open port that I am able to access outside the network. When I go to this port it will ask for a username and a ...
4
votes
1answer
338 views
How to distinguish between “normal internet” Port scan and more “serious” port scan preparing attack?
In a complete network infrastructure, with firewalls, routers, servers supervised by a SIEM, LogPoint here. Of course, there is a private network and public servers.
in the LogPoint there is an ...
8
votes
1answer
4k views
Connection to ports 2000 and 5060 successful despite filtering
I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP:
...
0
votes
1answer
468 views
ufw and nmap show different result in terms of open ports
I have set my firewall ufw / firewall rules as follows:
Default: deny (incoming), allow (outgoing), disabled (routed)
To Action From
-- ...
1
vote
0answers
50 views
Machine reaching out to Microsoft IP address using NBTstat command
I have limited logs for this event but the IPS says its a NBTstat query outbound over UDP port 137 to a Microsoft owned IP address.
Should UDP 137 ever reach out externally?
This is about all the ...
1
vote
2answers
341 views
My ISP blocks incoming ports so I can't even run webserver let alone 'reverse shell', any ideas? [closed]
I'm looking for ideas on how to run lab environment from "victim" test PC at work and "attacker" - my home PC.
Both are on separate ISPs, but it seems that my ISP at home blocks anyone trying to ...
3
votes
2answers
1k views
Should I allow incoming traffic from source port 443?
I am hosting a web server, both standard and SSL. Both work fine currently.
In my logs, I've noticed what seems like a distributed port-scan: 10-15 port queries from random hosts occuring within ...
0
votes
1answer
313 views
Replace Nmap with Nessus
I have to replace NMAP with Nessus. I got answer for few settings, but there are few settings in NMAP for which I am not able to get answer. If you could answer me, it would be helpful.
For example, ...
3
votes
2answers
237 views
do SRV records make a system more vulnerable or expose too much
We are all pretty comfortable with the fact that if ports 80 and 443 are open that these are for http even though some companies block 22 forcing people to repurpose 443 for ssh. So, those instances ...
7
votes
3answers
4k views
Nessus Port scan Vs NMAP Port scan
My objective is to find network vulnerabilities. I have used Nessus and NMAP both for vulnerability scan. I have to verify if I can use only "Nessus" rather than using "NMAP".
According to my ...
