Questions tagged [ports]
In computer networking a port is a software construct serving as a communications endpoint in a computer's host OS.
374
questions
3
votes
1answer
396 views
Nmap giving different result between Mac OS scan and Linux (Kali) scan [closed]
I try to do a simple TCP scan on an Kubunt VM (is on VirtualBox), from two different OS.
From the Host (Mac OS system) and from a Kali Linux VM (tried VirtualBox and Parallels also).
Kali Linux (...
3
votes
1answer
3k views
Nmap scan of iPhone public IP address shows port 21 open
I'm using my iPhone personal hotspot to connect to the internet on my computer via usb connection. I don't go through any other router or connection. The phone is my only means of connecting my ...
3
votes
0answers
655 views
What vulnerabilities are associated with port triggering?
Background
To address a VoIP voice lag issue, my provider added port triggering rules for over 42,000 ports on my router, which seemed sloppy. And as I understand it, port triggering should only be ...
2
votes
3answers
6k views
Why is UDP port scanning slower than TCP port scanning?
I can't seem to find an answer for this.
Any suggestions?
2
votes
2answers
21k views
Can a hacker hack into port 80?
We normally say port 80 is firewall friendly.
But can a hacker just hack into port 80 via TCP or UDP?
Or is Port 80 by default not always open?
It waits for the host to initiate a connection via ...
2
votes
3answers
201 views
Minimal usage in Windows 10 justify filtering all ports besides 22, 80, 443?
I use Windows 10 home on my personal computer. I opened up cmd and ran:
netstat -a
I saw a large list of ports that are on "LISTEN" mode and some others I couldn't recognize their state as I never ...
2
votes
5answers
7k views
How to make nmap list an unfiltered port?
I have a host that is NAT'ed and I have opened a single port in my router so the host is reachable by the external world. I tested if it was reachable by running a service and connecting to it ...
2
votes
2answers
1k views
I ran a netstat on my server and port 80 is listening, does that mean it is open and vulnerable to attacks? [closed]
Sorry I am just getting into Web Development and trying to learn more about servers and PHP, so I downloaded the LAMP stack on an Ubuntu14 OS and started an apache2 server.
tcp6 0 0 :::80 ...
2
votes
3answers
283 views
Closed Port security
I have what I think is a security IT question (I'm more of a programmer myself).
Assuming I am running a dedicated machine (say a PC) for a single program, meaning that the only port visible and open ...
2
votes
1answer
287 views
What is UDP port 56183
We seen suspicious probing from source port 53 to destination port 56183. May I know what services use port 56183 (udp)?
2
votes
2answers
3k views
What can be a reason you DONT want to use port 443 for SSL communications
I have a very open question which I dont know if it's allowed but I am so curious about any possible answer.
We are trying to make a connection to a other service for my company and the webservice ...
2
votes
2answers
2k views
Telnet port open on my router public IPv6 address
Recently I upgraded my home router into this one. It is a cheap one, but it has features I needed: IPv6 support and Gigabit Ethernet.
So I decided to give IPv6 a try. I configured a Hurricane ...
2
votes
2answers
906 views
Is there practical risk to having UDP ports open?
I understand that everything is potentially an attack vector, but I would like to ask a practical question about UDP ports
Suppose you're pentesting some small organisation and you found a couple of ...
2
votes
2answers
492 views
do SRV records make a system more vulnerable or expose too much
We are all pretty comfortable with the fact that if ports 80 and 443 are open that these are for http even though some companies block 22 forcing people to repurpose 443 for ssh. So, those instances ...
2
votes
3answers
4k views
Creating port-specific SSH authentication for the same user
I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN ...
2
votes
1answer
78 views
Access Control Lists - Why block a port rather than block a protocol?
I am studying for my Security + exam. I have just learned that ACLs can be designed to block ports and/or entire protocols. The book I am reading states an example:
"if you want to block HTTP traffic,...
2
votes
2answers
4k views
Most efficient way to scan for webservers
Lets say I want to scan a large amount of ip addresses for webservers running on port 80 (aware that there are other ports for webservers, ignoring for example).
What would be the most efficient way ...
2
votes
3answers
1k views
Is there any risk to having many “unused” ports open through firewalls and routers [duplicate]
I have a server I am using to host public internet services where I want to start and stop many instances, lets say up to 50 per physical server. The architecture of the software means each instance ...
2
votes
1answer
245 views
Dealing with “trojan” ports
We have a SOC which "monitors" our network activity, it basically collects all logs from all our firewalls and creates reports.
We have a huge network with hundreds of servers and upto 2000 users, ...
2
votes
3answers
5k views
How to scan for ports opened by TCP/UDP sockets with nmap or any other tool?
I'm new to nmap and I've been digging with it lately to scan some devices on the current LAN for ports opened by socket programs which are running.
First I ran a simple UDP server on my machine on ...
2
votes
2answers
14k views
Is Port Forwarding for bit torrent risky?
I have found that my connection decreased suddenly when downloading torrents. I diagnosed it with bit torrent and the answer is that i should do port forwarding on my modem/router! Is it risky?
2
votes
2answers
96 views
Risks of leaving my Redis port open and unsecure?
I left port 6005 open on a server of mine. Currently, if the server goes down, it won't be much of a loss. But my port 6005 is open for Redis queues and I don't necessarily want to have deal with it ...
2
votes
3answers
1k views
2 vs 3 tier network architecture
I am interested in how a 3-tier network topology (web/app/data) provides improved security than a 2-tier topology (web-app/data). I understand the concept of a DMZ as the initial contact point with ...
2
votes
1answer
250 views
Rogue device found on network
Whilst scanning my own network, I recently came across what seems like a rogue device. After running an nmap scan on it I found out it has four 'strange' ports open.
4096 (HTTP server)
13000 (Unknown,...
2
votes
2answers
680 views
What is this weird localhost IP traffic on multiple ports in the 5400-5600 range?
I am encountering an issue I recently have seen in my Fedora 23 machine (latest updates). I am getting about 130 IP packets passed back and forth over the lo interface in one go, every 1 second (like ...
2
votes
2answers
122 views
Why do ALGs restrict traffic on a given TCP port based on the protocol?
My understanding is that application level gateways restrict the traffic they proxy based on port and protocol - say HTTP over port 80 or MQTT over port 1883. Both types of traffic are using TCP as ...
2
votes
1answer
343 views
How to perform an idle scan against a target using Nmap with a list of zombies? [closed]
I want to perform port scan against a target but the firewall at the target only allows traffic to the ports through certain IP address/machines. I tried to perform an idle scan in Nmap but it only ...
2
votes
2answers
6k views
How do I scan my Routers Ports? [duplicate]
I recently scanned ports from within my LAN, but I recently read in order to determine whether Ports are open to the WAN I need to scan from outside the LAN, how do I do this?
2
votes
1answer
430 views
Static MAC address on Switches and routers
I was having a discussion with a friend of mine in IS industry and he insisted that setting static MAC addresses (i.e. port security) on devices were a effective way to block MAC spoofing. I found ...
2
votes
2answers
993 views
nmap output to file different than interactive output?
I am running a simple SYN scan of all ports on all hosts that I found on a previous ping scan saved to a file: targets like this:
nmap -sS -p- -v -T5 -oN puzzling.txt -iL targets
As the scan runs ...
2
votes
1answer
211 views
explanation of an nmap behaviour
I'm testing some vulnerabilities on a machine which has the port 22333 opened (it's used as the ssh port, and I can connect to it without any problem and the telned command get connected):
$ telnet ...
2
votes
1answer
1k views
nmap not running as root shows unknown open ports for a fraction of a second
On a server running Ubuntu 14.04.2 I was doing some basic security auditing when I ran the command nmap -p -d 1-65535 as a non-root user. Interestingly it reported a few (1-5 at a time, average, ...
2
votes
1answer
4k views
Telnet Open, is this an exploit? [closed]
I am pentesting a server, and it appears my ports are open for telnet.
Upon accessing telnet, if I type "help" I only get these commands:
telnet> help
Commands may be abbreviated. Commands are:
...
2
votes
1answer
1k views
Effective blocking of SMB connections on AsusWRT
I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
2
votes
1answer
4k views
GRC Shields Up test - are stealth ports good?
I used Steve Gibson's ShieldsUp test at https://www.grc.com.
All Service Ports test says that everything is green (stealth) expect one blue (closed).
I tried several times and one time, it gave me 2 ...
2
votes
1answer
524 views
Multiple users sharing the same IP
I'm setting up a quite unusual proxy for a very specific niche case.
I'm allocating (ip,port) addresses to users, from which they can send and receive UDP and TCP packets.
e.g. say someone is ...
2
votes
2answers
2k views
Nmap scan report with all port status
Is there a way to ask nmap to print the final scan report with the state of all ports tested and the reason?
For example when the scan is launched with --reason :
Nmap scan report for 127.0.0.1
...
2
votes
1answer
4k views
What is the fastest way to scan all ports of a single machine
I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about ...
2
votes
1answer
4k views
Detected Port Scanning Attack in ESET Smart Security
I receive a number of notifications from ESET Smart Security about Port Scanning attack. But I'm behind a router. But as far as I know, computers behind a router is not accessible from others (Please ...
2
votes
1answer
73 views
scan forwarded ports with OpenVAS/GVM?
I'm currently learning about network security and came across a problem, maybe I'm just missing something obvious but I'll try to explain my environment:
I have a Kali Linux VM connected to the WAN ...
2
votes
1answer
104 views
Can a VPN provider or actors within its infrastructure access open ports on the client machine?
From my understanding of a VPN, it essentially creates a network between the two 'machines'. So if I have open ports (e.g. HTTP, SSH) on my client machine, those can be accessed by the VPN provider or ...
2
votes
1answer
541 views
Is it safe to have port 443 unprotected by firewall without application?
Say I have a website, http://www.mostlysecuresite.com, which runs on a server at my house. Let's say I wanted to get an SSL cert in a few weeks. Because of this, I had my Port 443 forwarded on my ...
2
votes
1answer
202 views
Port Knock logs suggest machine has been compromised?
On my CentOS machine, all my ports are filtered with the Iptables rule:
DROP all -- * * 0.0.0.0/0 0.0.0.0/0
So from the Internet, every port timeouts.
The only way to ...
2
votes
1answer
355 views
Eavesdropping on a specific port of machine in the WLAN from a different machine, possible? (using arpspoof)
I'm using netcat -l 555 option to communicate between two computers(Linux) on port 555, is there any way I can eavesdrop to whats going on in that conversation from a 3rd computer?
After the second ...
2
votes
1answer
2k views
Open ports on router
I have a TP-Link TD W8970 modem/router. Just for fun i tried to perform a port scan on it. I found this:
$ nmap -p 1-65535 -n 192.168.1.1
Starting Nmap 6.00 ( http://nmap.org ) at 2016-01-21 16:17 ...
2
votes
2answers
173 views
Opening remote MySQL database to office IP address at default MySQL port risks?
I read a few questions regarding this topic that were pretty informative, but still wanted to pose my particular case.
My company wants to put our data in the MySQL tables we have through our web ...
2
votes
1answer
945 views
Understanding nmap output / author explanation …(Scapy)
I just read this example and explanation (below) in the OReilly book Security Power Tools (2007) in section 6.3 that is written by the creator of Scapy, Philippe Biondi. I think the example is very ...
2
votes
1answer
3k views
Why is nmap that slow on my system (ubuntu 14.04)?
I just started to learn something about portscanning with nmap. when i try to run an a nullscan or any other type on a virtual machine (win7 no firewall) the scan needs a lot of time to perform:
sebi@...
2
votes
1answer
864 views
How should I audit and monitor shared TCP ports in Windows?
Windows has a feature called .NET TCP Port Sharing which allows different .NET applications to share the same TCP/IP port.
I would like to monitor the source and destination connections of each ...
2
votes
0answers
2k views
Using burp suite, how can I intercept traffic from one localhost port, but not another one
I have one webapp available on localhost:12345, and another service running on `localhost:6789'. I want to monitor the traffic to/from the webapp (12345), but universally pass the traffic to the ...
