Questions tagged [ports]

In computer networking a port is a software construct serving as a communications endpoint in a computer's host OS.

Filter by
Sorted by
Tagged with
5
votes
2answers
8k views

How should an outgoing connection white-list be created?

I see my previous question was closed as duplicate of Why block outgoing network traffic with a firewall?. The answers that everyone agree with mention the value of blocking outgoing connections (to ...
4
votes
3answers
7k views

How to figure out which open ports or services are insecure?

We have around one thousand machines on internet. We do port scanning with nmap, and find many ports open on these machines. Sometime we found administrative website using HTTP instead of HTTPS, we ...
4
votes
2answers
485 views

Is is bad practice to use non-standard ports? (for example ssh from 22 to something different)

Background is that I am learning some technical stuff with the Enki App. In this case about security. The App states that it is a misuse of a port if I change for example the ssh port from 22 to ...
4
votes
4answers
5k views

How can I scan open ports without being traced back

I would like to scan open ports of a server. But as far as I know, when I try to scan the open ports with something like nmap in shell they would be able to trace me. Is there a way to secure this ...
4
votes
3answers
3k views

Is there is a way to lock my USB port over the device physically?

Is there is a way to lock my USB port over the device physically ? For example I am connecting the USB mouse and keyboard on an public computer but I do not want anyone to remove them physically. I ...
4
votes
1answer
5k views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
4
votes
1answer
641 views

How to distinguish between “normal internet” Port scan and more “serious” port scan preparing attack?

In a complete network infrastructure, with firewalls, routers, servers supervised by a SIEM, LogPoint here. Of course, there is a private network and public servers. in the LogPoint there is an ...
4
votes
2answers
20k views

Does portforwarding present a risk to anonymity?

AirVPN by default has all ports closed but allows port-forwarding. I think this is required for P2P. Is this a threat to anonymity (e.g. would the person at the other end of the P2P transmission know ...
4
votes
1answer
809 views

General techniques for identifying an unknown service

I have a specific sample I'd like feedback on, but my view is an answer about general techniques is more valuable for this site. I'll leave the details in, in case anyone googling this bumped into the ...
4
votes
1answer
2k views

Analyzing wireshark results (openvpn)

I signed up to Mullvad for VPN service, and manually run OpenVPN from my Linux box. I rebooted my computer and make sure not to start any OpenVPN service. Yet when I did a Wireshark analysis I am ...
4
votes
1answer
347 views

My home modem-router is occupying most subnets

I was port scanning my own isp-issued modem-router and stumbled upon something unsettling: looks like it is listening on ports 554, 7070 & 1863 on (almost) every ip of this interval: 192.168.0-255....
4
votes
2answers
397 views

How common is port-knocking? [closed]

Today I read about port-knocking for the first time. It has been a pretty known concept for more than ten years, but I don't know anybody who uses it for their servers. How common is the usage of ...
4
votes
3answers
7k views

Setup of Kali Linux for reverse shell connections over the internet

I am running Kali Linux as a VM on my Windows machine which is NAT'd behind my company network, if I wish to pen test a website for a client and believe that a reverse shell is possible, what is a ...
4
votes
1answer
3k views

Nmap scan of iPhone public IP address shows port 21 open

I'm using my iPhone personal hotspot to connect to the internet on my computer via usb connection. I don't go through any other router or connection. The phone is my only means of connecting my ...
3
votes
2answers
3k views

How to force nmap to check all the ports?

I heard that nmap scans for only 1000 most common ports while we do server scan. Is it possible to force nmap to check all the ports for scanning? If yes,How?
3
votes
2answers
7k views

SUN Remote Procedure Call Port 111 [closed]

I have found on my machine port 111 is open. This is listed as RPC. I understand there are possible attacks on this port. How can my machine be attacked if port 111 is open? How can I secure this ...
3
votes
3answers
20k views

Why is system32/ntoskrnl.exe blocking port 80? [closed]

Today I've tried to start the Visual Studio Developer IIS as usual on Port 80, but this time it has quit with an error that port 80 is already in use. With netstat I've found out, that an application ...
3
votes
1answer
1k views

Ports Showing Closed/Filtered in Nmap Scans

hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other ...
3
votes
2answers
3k views

Is my ISP doing a port scan on my computer?

I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically: 11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY DST=192.168.1....
3
votes
2answers
7k views

how to identify p2p on network

Im trying to work out if the traffic in the below image is P2P file sharing? If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
3
votes
6answers
2k views

What are the best pratices to avoid my server being port scanned

The title probably says it all. I just wanna know what are the best technics to avoid having a port scanner detecting open ports on my server. I'm using a Linux distro as my OS (Ubuntu Server).
3
votes
2answers
463 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
3
votes
2answers
2k views

Should I allow incoming traffic from source port 443?

I am hosting a web server, both standard and SSL. Both work fine currently. In my logs, I've noticed what seems like a distributed port-scan: 10-15 port queries from random hosts occuring within ...
3
votes
2answers
9k views

What purpose serve port 1900 in home router

Why would home router have port 1900/tcp (upnp) open? What kind of purpose would that serve for the operator (service provider)? I searched info about it and found this an article saying: Security ...
3
votes
1answer
687 views

Internal IP addresses allowed access to all DMZ hosts

Hi basically I'm doing a vulnerability assessment for at the moment. The setup includes a DMZ with a single firewall and an internal network (3 legged network model employing a single DMZ) but on the ...
3
votes
1answer
10k views

Does connection that use 0.0.0.0 in Foreign Address secured?

When I run my application on Centos the specific process opens port that listens for connections from localhost, but uses 0.0.0.0 in Foreign Address. Is it secured? netstat -plunt Active Internet ...
3
votes
2answers
288 views

Should ports be visible to nmap?

I'm currently working on the firewall when I discovered that the firewall exposes a lot of ports outside of the internal network. I discovered this when setting up a new FTP server using a basic nmap ...
3
votes
1answer
628 views

Common attacks when no ports are open

If you have a web server with all ports closed (except, of course, the necessary HTTP) what kind of attacks can an attacker use to hack into the system? Are the only vulnerabilities stuff like ...
3
votes
2answers
6k views

How to configure iptables for must open ports?

On my machine there are web services which can be accessed from any PC connected to the same network segment (WiFi for example). I want to use IPtables on the machine to prevent any web services from ...
3
votes
2answers
162 views

Auditing Existing Socket Connection

Is there any way to interact with a program's socket traffic without installing Winpcap? I understand that the one listening program per port is a restriction regarding TCP/IP, but I guess I'm more ...
3
votes
3answers
7k views

Is QUIC (Quick UDP Internet Connections) safe to allow through firewall?

Our firewall currently blocks QUIC (UDP 443) traffic which seems to be enabled by default in Google Chrome. Is it safe to allow QUIC or should I wait until it is implemented in all the major browsers? ...
3
votes
1answer
174 views

Is it possible to find out what a remote user is trying to do connecting to a closed port?

From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number: Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 MAC=xx:...
3
votes
2answers
366 views

Nmap and it default scripts when I already know some of the information

I am a network guy and not a “hacker” or whatever the official term is these days. I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure. The thing is ...
3
votes
1answer
1k views

Some explanation on Maimon Scan

I'm facing this question: When could the Maimon Scan be usefull? As I had no idea of what it was, I went into Nmap's manual and saw the explanation: The Maimon scan is named after its ...
3
votes
2answers
5k views

Scanning multiple subnets with nmap to determine open services & ports

First off, I know nmap's documentation is very powerful and I have been reading through it rather extensively. I will be scanning externally, with permission, to determine ports & services that ...
3
votes
1answer
3k views

Unknown Service Identification

How can one identify a service running on a non-standard port? I'm not talking about services like webserver or FTP since nmap can do that without any problems. I'm talking about services that are not ...
3
votes
2answers
965 views

How to practically detect current system net traffic?

I know that some viruses or trojans can install rootkits or bootkits to change system's normal behaviour; AFAIK for example filter queries for running processes or even hide active TCP ports. My ...
3
votes
1answer
67 views

Azure publicly exposed resources

Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from ...
3
votes
1answer
454 views

Reverse shell on a web server behind Netscaler

How possible is it for a reverse shell to connect back to the attacker if the vulnerable web server only has Http ports open like 80 and 443 through the Netscaler behind the perimeter firewall? ...
3
votes
1answer
2k views

All ports are unfiltered

I'm currently studying a peneteration/hacking course. I am trying to use nmap against a target to find all the ports that are filtered. I thought if I used an ACK-scan nmap would give me all the ...
3
votes
1answer
1k views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the quad-...
3
votes
1answer
1k views

What do Msgsrvr and Scientia-ssdb do?

I'm having a task in a computer security class in school where I'm supposed to scan a host for open ports in order to find out what services are being run there. I have found out (among other things) ...
3
votes
1answer
160 views

Nmap giving different result between Mac OS scan and Linux (Kali) scan [closed]

I try to do a simple TCP scan on an Kubunt VM (is on VirtualBox), from two different OS. From the Host (Mac OS system) and from a Kali Linux VM (tried VirtualBox and Parallels also). Kali Linux (...
3
votes
0answers
572 views

What vulnerabilities are associated with port triggering?

Background To address a VoIP voice lag issue, my provider added port triggering rules for over 42,000 ports on my router, which seemed sloppy. And as I understand it, port triggering should only be ...
2
votes
2answers
14k views

Can a hacker hack into port 80?

We normally say port 80 is firewall friendly. But can a hacker just hack into port 80 via TCP or UDP? Or is Port 80 by default not always open? It waits for the host to initiate a connection via ...
2
votes
3answers
199 views

Minimal usage in Windows 10 justify filtering all ports besides 22, 80, 443?

I use Windows 10 home on my personal computer. I opened up cmd and ran: netstat -a I saw a large list of ports that are on "LISTEN" mode and some others I couldn't recognize their state as I never ...
2
votes
3answers
5k views

Can nmap take a list of ports to scan from a file?

Nmap can take a file containing a list of hosts to scan using the -iL flag. Is there similar functionality for a file containing a list of port numbers? I've scoured the man page, online docs at nmap....
2
votes
5answers
6k views

How to make nmap list an unfiltered port?

I have a host that is NAT'ed and I have opened a single port in my router so the host is reachable by the external world. I tested if it was reachable by running a service and connecting to it ...
2
votes
3answers
8k views

Does an open port with no service listening on it pose a risk? [duplicate]

I have a home server running Ubuntu 16.04 Server Edition. I have a couple ports that my router forwards to my server and ufw on my server allows so that I can access the services outside the LAN - ...
2
votes
2answers
1k views

I ran a netstat on my server and port 80 is listening, does that mean it is open and vulnerable to attacks? [closed]

Sorry I am just getting into Web Development and trying to learn more about servers and PHP, so I downloaded the LAMP stack on an Ubuntu14 OS and started an apache2 server. tcp6 0 0 :::80 ...

1 2 3 4 5 7