Hot answers tagged

199 votes
Accepted

Is it theoretically possible to deploy backdoors on ports higher than 65535?

No, the port number field in a TCP header is technically limited to 2 bytes. (giving you 2^16=65536 possible ports) If you alter the protocol by reserving more bits for higher ports, you're violating ...
user avatar
  • 43.7k
64 votes

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
user avatar
  • 63.8k
63 votes

Is it safer to use a port other than 21 for FTP?

It is not safe to use ftp over any port. Those who have a malicious intent to get in your network or system will not scan your system for port 21 but for all ports, and will figure the other port in ...
user avatar
  • 706
62 votes
Accepted

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
user avatar
  • 5,724
55 votes

How do you deal with massive port scans?

I ignore them. And if you have a reasonable security posture, you should too. Your servers should have no ports open to the general public other than those that you use to serve the general public. ...
user avatar
  • 82k
54 votes
Accepted

Why do hackers scan for open ports?

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs ...
user avatar
  • 48.8k
48 votes
Accepted

I have found ports on my Samsung smart tv running a display service. What can I do with it?

While this isn't strictly a security question, I'm unsure if the Stack Exchanges for Super User or Networking would take this, so I'll just answer it quickly: Depending on your options, nmap will ...
user avatar
  • 14.3k
44 votes

How wise is it to use a tool for portspoofing at your server to confuse attackers?

Multiple problems here. Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence. You're burning CPU ...
user avatar
41 votes
Accepted

Why is it better to use ports 20 and 53 as source ports when portscanning?

You guessed correctly. According to the Nmap Reference Guide: --source-port <portnumber>; -g <portnumber> (Spoof source port number) One surprisingly common misconfiguration is to trust ...
user avatar
  • 3,552
36 votes

Is it safer to use a port other than 21 for FTP?

The reason FTP is generally considered insecure is because it is not encrypted, which means that if someone is sniffing traffic anywhere in the network path, then everything traversing it can be read. ...
user avatar
  • 9,122
30 votes

Is there any meaning in only allowing port 80 and 443 today?

Blocking all ports except 80 and 443 can be part of a good defense in depth strategy. If it is your only strategy then you are correct, it will be a flawed one. A potential exampled layered approach ...
user avatar
  • 4,971
28 votes

Is it theoretically possible to deploy backdoors on ports higher than 65535?

No, it's that number because the TCP field for that is only 16 bits long (65536, but starting at 0), so it is fundamentally impossible to communicate a higher port than 65535 This post has a really ...
user avatar
  • 4,783
26 votes

Is there any meaning in only allowing port 80 and 443 today?

You're absolutely correct. There's nothing magical about port 80, or port 443. There's nothing inherently secure about one port or another, or even one protocol or another. If you block everything ...
user avatar
  • 21.5k
25 votes

Is it theoretically possible to deploy backdoors on ports higher than 65535?

If you rebuilt the TCP/IP stack locally on the machine, would the overall concept not work due to how the RFC 793 - Transmission Control Protocol Standard works as mentioned below in some of the ...
user avatar
  • 22.5k
22 votes

Security risk of opening port 111 (rpcbind)?

If you expose this service to the internet, everybody can query this information without having to authenticate. It can be useful to attackers to know what you have running. Also, the RPC service has ...
user avatar
  • 1,311
19 votes

How do you deal with massive port scans?

I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs. For example, I created an AWS app that turns up ...
user avatar
  • 1,115
18 votes
Accepted

What are non-standard ports and protocols

A non-standard port just means a service running on a port other than its default, usually as defined by the IANA port numbers registry. Running a service on a non-standard port doesn't really mean ...
user avatar
  • 132k
16 votes
Accepted

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

How could a IANA reserved port(tcp/0) handle traffic? It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are ...
user avatar
  • 3,395
14 votes
Accepted

What's the diff between blocking a port with a firewall and not starting a service on that port in the first place?

TL;DR It protects against having to manually configure services to only listen on localhost, as you have to manually allow them network connectivity, and it increases the effort an attacker must ...
user avatar
  • 420
14 votes
Accepted

GHOST: which services are vulnerable, ssh, web server?

One can reasonably conclude (see below) that it will require some detailed analysis to determine if an arbitrary software package is vulnerable, and what configuration or mitigations may apply. Any ...
user avatar
  • 7,917
14 votes
Accepted

Security implications of granting non-root access to privileged ports (<1024)

When you're using rootless Docker/Podman, the risks of allowing users to bind ports < 1024, generally depend on what else is happening on the system. TBH the old restriction on low ports doesn't ...
user avatar
  • 60.7k
13 votes

Using non standard port numbers

If the port is accessible from the outside, it cuts down on the number of random scan: most of the simplest automated scanners will simply check the default port. However, it can also induce a false ...
user avatar
  • 18.5k
12 votes

Is there any meaning in only allowing port 80 and 443 today?

White-listing is generally preferable to black-listing. If you only open the ports you actually need, and if you limit those ports to the extent possible, then you've reduced your attack surface area ...
user avatar
  • 35.5k
12 votes

Is it safer to use a port other than 21 for FTP?

If your FTP server is always kept up to date, then usually that means there are not going to be any known exploits against that application. On the other hand, if the server is out of date then you ...
user avatar
  • 13.8k
12 votes

Security implications of granting non-root access to privileged ports (<1024)

It depends on your system. If it's a multi-user system with multiple users able to run docker, you may fall victim to a race attack, where a malicious docker container is started when your legitimate ...
user avatar
  • 12.5k
11 votes

What is the safest way to ssh to a machine behind a router?

There are many automated bots out there that will try to attack SSH servers, but if you take a few precautions you can actually make SSH very safe. Disable password-based login completely, and make ...
user avatar
  • 10.2k
11 votes
Accepted

Is there a nmap command to get the top # most common ports?

In addition to sorting the nmap-services file as SilverlightFox suggests, you can get this information from Nmap: $ ./nmap --top-ports 1000 localhost -v -oG - # Nmap 6.47SVN scan initiated Wed Jan 7 ...
user avatar
  • 11.3k
11 votes

Using non standard port numbers

It slightly offers some benefits. This is so called security through obscurity. There are many scanners active on the internet that have a default set of ports that they scan (like 21 (FTP), 22 (SSH), ...
user avatar
  • 400
11 votes

What are the best pratices to avoid my server being port scanned

Portknocking Portknocking is a method to open ports that the firewall normally keeps closed by executing a series of connection attempts (knocks) to other ports. Upon the valid sequence of port knocks,...
user avatar
  • 2,724
10 votes

Is there a nmap command to get the top # most common ports?

sort -r -k3 /usr/share/nmap/nmap-services should give you what you need. This will sort the nmap-services file by open-frequency. http 80/tcp 0.484143 # World Wide Web HTTP ipp 631/udp 0....
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible