Questions tagged [ports]

In computer networking a port is a software construct serving as a communications endpoint in a computer's host OS.

Filter by
Sorted by
Tagged with
1
vote
0answers
55 views

Machine reaching out to Microsoft IP address using NBTstat command

I have limited logs for this event but the IPS says its a NBTstat query outbound over UDP port 137 to a Microsoft owned IP address. Should UDP 137 ever reach out externally? This is about all the ...
1
vote
2answers
370 views

My ISP blocks incoming ports so I can't even run webserver let alone 'reverse shell', any ideas? [closed]

I'm looking for ideas on how to run lab environment from "victim" test PC at work and "attacker" - my home PC. Both are on separate ISPs, but it seems that my ISP at home blocks anyone trying to ...
3
votes
2answers
1k views

Should I allow incoming traffic from source port 443?

I am hosting a web server, both standard and SSL. Both work fine currently. In my logs, I've noticed what seems like a distributed port-scan: 10-15 port queries from random hosts occuring within ...
0
votes
1answer
339 views

Replace Nmap with Nessus

I have to replace NMAP with Nessus. I got answer for few settings, but there are few settings in NMAP for which I am not able to get answer. If you could answer me, it would be helpful. For example, ...
3
votes
2answers
255 views

do SRV records make a system more vulnerable or expose too much

We are all pretty comfortable with the fact that if ports 80 and 443 are open that these are for http even though some companies block 22 forcing people to repurpose 443 for ssh. So, those instances ...
7
votes
3answers
5k views

Nessus Port scan Vs NMAP Port scan

My objective is to find network vulnerabilities. I have used Nessus and NMAP both for vulnerability scan. I have to verify if I can use only "Nessus" rather than using "NMAP". According to my ...
25
votes
2answers
5k views

How wise is it to use a tool for portspoofing at your server to confuse attackers?

I came across this tool recently https://github.com/drk1wi/portspoof How efficient will it be to use it to confuse hackers doing port scanning? If it's actually going to be pretty efficient, why ...
12
votes
2answers
3k views

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

Performed credentialed Vulnerability scan on linux/Unix servers by Nessus and thousand of vulnerability came out of port tcp/0. How could a IANA reserved port(tcp/0) handle traffic? Are those ...
1
vote
1answer
97 views

Security of a Unity 2017 Cache Server

I am currently running a cache server on an ubuntu machine on our local network for an upcoming game. We have several off-site members of our team who would like to make use of the cache server too. ...
2
votes
3answers
196 views

Minimal usage in Windows 10 justify filtering all ports besides 22, 80, 443?

I use Windows 10 home on my personal computer. I opened up cmd and ran: netstat -a I saw a large list of ports that are on "LISTEN" mode and some others I couldn't recognize their state as I never ...
1
vote
1answer
48 views

Port filtering for Ubuntu-Nginx minimal server environment

I've established a minimal, uncustomized LEMP stack (Ubuntu 16.04). The only server I have besides Nginx is Postfix. To protect that environment I filtered all ports besides a few, this way: ufw ...
0
votes
2answers
354 views

Should I keep incoming data UDP ports open in a minimal server environment?

I have a minimal, uncustomized Ubuntu 16.04 xenial Nginx server environment with only these incoming data TCP ports unfiltered: 22, 80, 443, 9000 When reviewing /etc/csf/csf.conf I found out that ...
1
vote
2answers
3k views

Most efficient way to scan for webservers

Lets say I want to scan a large amount of ip addresses for webservers running on port 80 (aware that there are other ports for webservers, ignoring for example). What would be the most efficient way ...
0
votes
3answers
197 views

Can an attacker with MitM privileges perform denial of service and other attacks besides interception on local LAN?

I would like to better understand what an attacker who has MitM control on a LAN can do to the victim. I understand that basically a MitM attack means you intercept traffic and can see the data [and ...
-1
votes
1answer
17k views

How can I check open ports on android? [closed]

I know that every ISO based network system uses TCP port, and Android is of course not an exception. My question is, can I check the open ports in my device? Can I close them? Is there an app to ...
1
vote
2answers
262 views

How can a computer found on traceroute show all ports closed?

I ran a traceroute on a website I'm connecting to and got the following output: 1 skyrouter (192.168.0.1) 3.989 ms 1.389 ms 1.916 ms 2 * * * 3 be397.pr2.thlon.isp.sky.com (2.120.11.8) 31.564 ...
1
vote
1answer
1k views

Port scans: 'traffic denied' VS 'close - age out'

I have been investigating logs from the firewall (Juniper) and I've found out that when someone is portscanning my website, the majority of the traffic through different tcp/udp ports is denied (...
-1
votes
1answer
42 views

How to connect to external address as other outgoing port number without proxy [closed]

Is it possible to (mask / define) outgoing port locally on network without using a proxy? default (outgoing protocol) [address] [port] set to (outgoing protocol) [address] [selected port] There ...
0
votes
1answer
84 views

Why is it bad to open ports to ip cams? How does a VPN fix this?

I have been running a couple home web cams that I can view when away from home, by opening ports on my router. They are strongly password protected. An IPCam forum that I read says that you should ...
1
vote
2answers
1k views

NMap scan from within armitage - missing root privileges

I just installed metasploit + armitage on my Ubuntu 16.04 machine. When I start armitage and click "Hosts->Nmap->Quick Scan (OSdetect)" I get the following error: msf > db_nmap --min-hostgroup 96 -...
3
votes
1answer
376 views

Reverse shell on a web server behind Netscaler

How possible is it for a reverse shell to connect back to the attacker if the vulnerable web server only has Http ports open like 80 and 443 through the Netscaler behind the perimeter firewall? ...
3
votes
5answers
1k views

What are the best pratices to avoid my server being port scanned

The title probably says it all. I just wanna know what are the best technics to avoid having a port scanner detecting open ports on my server. I'm using a Linux distro as my OS (Ubuntu Server).
1
vote
1answer
254 views

Potential intrusion on home network?

I was browsing through my home network linksys router logs today and noticed an incoming connection from 41.212.36.114 to port 44543. I checked out this IP address at it's coming from Kenya. I'm in ...
1
vote
3answers
2k views

How to chose a port to run an application on localhost? [closed]

I'm considering developing a web application for my own usage on desktop, running on localhost, automatically launched at startup. I'll need to chose a port to do so. What I'm uneasy about is the ...
0
votes
1answer
311 views

Are there open by default ports with Centos 7's firewalld?

My Centos7 firewalld has TCP ports 8083, 8086, and 5000 open. I don't recall opening them, except for maybe 5000 when first learning about firewalld. Are there any ports that might come out of the ...
1
vote
1answer
370 views

have opened HTTPS port but still no response [closed]

I have watchguard firewall and server behind it configured with NAT. I was told to open port https for 1 of the server. I have create a rule from any to the NAT server to allow port 443, the ...
1
vote
2answers
6k views

Why are there open ports on my home network router?

It can be a security risk to have unwarranted open ports. So I ran nmap 192.168.0.1 to investigate if I had open ports on my home network, it turns out, I do: PORT STATE SERVICE 53/tcp open ...
1
vote
0answers
282 views

Nethogs showing several IP addresses and ports - Port sniffing?

I have a small Ubuntu server (VPS from provider with control panel) machine for practice purposes - no production or critical stuff. I've set up ufw and nginx with a sample index.html page. I control ...
-3
votes
2answers
1k views

Insecure/Obsolete TCP/UDP Ports? [closed]

I used CurrPorts to monitor TCP/IP network connections. This image shows when I don't connect to the Internet but I don't know why Avast Antivirus established this port. Is it insecure? This image ...
0
votes
2answers
410 views

Open port on my router I never seen before (port 12345)

Today I scanned my router and found out open port 12345, which when googled displays to be NetBus which is potential threat. As a reference I scanned my router many times before for open ports (all ...
0
votes
1answer
2k views

Nmap “adjust_timeouts2” error

Just tried a port scan against a cloudflare protected website: nmap -sV --version-intensity 9 --top-ports 2500 -v --script banner --data-length 0 -n <ip address here> -Pn -T2 -sT I get a lot ...
0
votes
1answer
238 views

What ports should I filter on a default Magento installation

I have recently installed a Magento on Ubuntu 14.04 on Digital Ocean and I'm wondering what ports should I filter to keep it safe. Well, actually the question should be: what ports I keep open to the ...
2
votes
3answers
776 views

Is there any risk to having many “unused” ports open through firewalls and routers [duplicate]

I have a server I am using to host public internet services where I want to start and stop many instances, lets say up to 50 per physical server. The architecture of the software means each instance ...
1
vote
2answers
468 views

REJECT Nikto Scans With Snort Rules

Hoping someone on here knows a way to reject Nikto traffic with Snort rules. I've been having zero luck for days finding this anywhere online. Thanks. Peace.
0
votes
3answers
1k views

Is Open Port 25 on Web Server dangerous?

Port 25 of a web server is open. We dont have any email server, since we use google mail server, but still port 25 is open. Is it dangerous to keep it open? If it can be attacked then how it can be ...
0
votes
1answer
309 views

How to block an application with iptable which use random port

Scenario: My goal was to allow TeamViewer to connect to my home workstation from my laptop only. So I have tried to bind my laptop's MAC with an IPtables rule as following, [arif@arif:~]$ sudo ...
0
votes
1answer
761 views

What would cause a port scan to an email server in an office?

I supply email accounts to customers. Occasionally some customers are blocked by our firewall (CSF) if they get the usernames or password wrong. But sometimes they get blocked because their IP address ...
1
vote
2answers
600 views

Port forwarding and port blocking security concerns

I am highly concerned about RDP security and about multiple occasions of ransomware infections through RDP, so now I am inspecting possibilities for self-defense against these threats. What interests ...
2
votes
2answers
2k views

Service running on a closed port?

I just finished scanning a host and I found something unusual. My question is regarding port 50000 and 50002. Nmap shows that these ports are closed and also identifies the services running on them!...
0
votes
2answers
688 views

What possible attacks might occur on a SQL Server TCP/IP port?

We have a VPS that contains a SQL Server Express instance. Using SQL Server Configuration we have enabled TCP/IP to listen on a random port, say 5741. We have disabled sa and created another user with ...
1
vote
0answers
184 views

zenmap scan explanation for open port & services

I recently scanned my router domain and get this result: What I get from that report is 3 of 1000 my ports are open. But what to do with "telnet" and "BusyBox telnetd" also "ISC BIND Hostmaster"? ...
2
votes
1answer
722 views

Effective blocking of SMB connections on AsusWRT

I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
1
vote
1answer
96 views

About slowloris dos attack in skype

So I scanned my home pc for fun with nmap "vuln" script and it said something about the slowloris vulerability at port 443 . So I started up slowloris.pl and it really worked . After that I wondered ...
5
votes
1answer
582 views

Hardening/Security considerations for torrent clients

I am running Synology's DSM torrent client on a NAS. As I have to (?) open and forward one UDP port for DHT and another one (UDP/TCP) for data transmission I am exposing myself to threats originating ...
1
vote
2answers
4k views

Why TCP port 6666 and port 7777 open in a LTE router?

I've got a LTE wifi router(JioFi 2) and there's port 6666 and 7777 are open. Nmap scan result, PORT STATE SERVICE 53/tcp open domain 80/tcp open http 6666/tcp open irc 7777/tcp open cbt ...
1
vote
0answers
149 views

Are ephemeral ports random by default in Windows?

I'm analyzing a malware and I've noticed that it is doing some form of ephemeral port exhaustion. My question: Is it normal for ephemeral ports in a Windows system to be selected in series (i.e. ...
2
votes
1answer
188 views

Rogue device found on network

Whilst scanning my own network, I recently came across what seems like a rogue device. After running an nmap scan on it I found out it has four 'strange' ports open. 4096 (HTTP server) 13000 (Unknown,...
0
votes
1answer
1k views

Strange devices & open ports on my network

I have performed several Nmap scans on my network to determine what devices are connected and which ports are open. To my surprise I found a very strange device connected(which I do not know ...
8
votes
1answer
2k views

Nmap - Intense vs Quick result

I inherited a small network and currently am assessing its security performance. I started port scanning a host (lets call it Weirdo) in that small network and from my perspective, it seems that that ...
0
votes
1answer
114 views

server that responds on any port [closed]

I want to make a server that responds open to every port that is scanned by nmap (TCP and UDP). Are there a simple solution to do that?