Hot answers tagged

198

No, the port number field in a TCP header is technically limited to 2 bytes. (giving you 2^16=65536 possible ports) If you alter the protocol by reserving more bits for higher ports, you're violating the specification for TCP segments and wouldn't be understood by a client. In other words, you're not speaking TCP anymore and the term "port" as in "TCP ...


63

It is not safe to use ftp over any port. Those who have a malicious intent to get in your network or system will not scan your system for port 21 but for all ports, and will figure the other port in virtually no time. You are better with sftp as your file transfer tool. On the other hand, you have the option of adding some security to your ftp transfers ...


63

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank for sites that do not HTTPS, and adding a browser warning when a site is not secure. However, the ratio of HTTPS sites to not is still far too low to recommend ...


60

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) to tell browsers to remember to only use TLS when connecting to your site in the future. There is nothing insecure about port 80 being open. Security issues ...


53

I ignore them. And if you have a reasonable security posture, you should too. Your servers should have no ports open to the general public other than those that you use to serve the general public. For example, your web server should have open port 80, 443, and maybe 22; everything else should be SSH-tunneled or otherwise VPN'ed if you need to connect to ...


52

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs implement them and preferably the versions of those programs). To fingerprint a service, the attacker needs to know that there is one running on a publicly ...


48

While this isn't strictly a security question, I'm unsure if the Stack Exchanges for Super User or Networking would take this, so I'll just answer it quickly: Depending on your options, nmap will return different results for ports because different steps for service reconnaissance are taken. Since you seem to use a GUI to nmap and are asking a security ...


44

Many modern home routers usually come with a feature called Universal Plug and Play (UPnP) to allow NAT traversal using the IGD Protocol. What that means is that an application can ask the router "Hey, could you please let external computers speak to me on port xxxx", then the router creates a port map for the requested port. UPnP has a variety of security ...


44

Multiple problems here. Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence. You're burning CPU to respond to the reconnaissance phase of an attack. This can be used against you. Depending on how this is set up, I can kill your server by forcing your ...


41

You guessed correctly. According to the Nmap Reference Guide: --source-port <portnumber>; -g <portnumber> (Spoof source port number) One surprisingly common misconfiguration is to trust traffic based only on the source port number. It is easy to understand how this comes about. An administrator will set up a shiny new firewall, only to ...


36

The reason FTP is generally considered insecure is because it is not encrypted, which means that if someone is sniffing traffic anywhere in the network path, then everything traversing it can be read. This includes the username, password, all the data being transferred, and which port is being used. Using a non standard port will not increase security, but ...


30

Blocking all ports except 80 and 443 can be part of a good defense in depth strategy. If it is your only strategy then you are correct, it will be a flawed one. A potential exampled layered approach may be Block all ports at the external firewall minus 80/443 Have an inline IPS (or as part of your firewall) do packet analysis Sanitize web-app input with a ...


28

No, it's that number because the TCP field for that is only 16 bits long (65536, but starting at 0), so it is fundamentally impossible to communicate a higher port than 65535 This post has a really nice writeup on why this is so in IPv4, how it's the same in IPv6, and how you can reuse ports in regular use.


25

You're absolutely correct. There's nothing magical about port 80, or port 443. There's nothing inherently secure about one port or another, or even one protocol or another. If you block everything but HTTP, everyone will simply start using HTTP. The attackers can and do always move faster than everything else. They aren't limited by maintaining old ...


25

If you rebuilt the TCP/IP stack locally on the machine, would the overall concept not work due to how the RFC 793 - Transmission Control Protocol Standard works as mentioned below in some of the answers? Making it impossible to access a service running on a port higher then 65535. There are no TCP/UDP services on ports higher than 65535. If it ...


19

You're most likely hitting a well-configured IDS/IPS appliance. snort can easily detect your port scan in progress with the sfPortscan filter (the -sS is practically a "portscan in progress" signature), and in addition to logging your attack, it can be configured to perform an active response. These responses can be as simple as sending you an RST, or as ...


19

If you expose this service to the internet, everybody can query this information without having to authenticate. It can be useful to attackers to know what you have running. Also, the RPC service has a history of security vulnerabilities. So don't expose it to the world unless you have to.


18

I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs. For example, I created an AWS app that turns up spot instances, scans blocks of IPs from a list, and turns them off once the results are shipped to the master server. If I was scanning your range daily you ...


18

A non-standard port just means a service running on a port other than its default, usually as defined by the IANA port numbers registry. Running a service on a non-standard port doesn't really mean anything for security. It may reduce the amount of noise that a defender has to deal with in terms of automated scanning on the internet, where bots usually ...


16

How could a IANA reserved port(tcp/0) handle traffic? It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are designed it's not that easy to bind on port zero, it's nevertheless possible to use it. However, it's highly unlikely that this is actually happening in your ...


14

Yes, it is a good idea to lock down all of the hosts inside the firewall as well to protect against any threats coming from your internal network. That way, if someone gains access to your network or if there is a virus/worm/etc attacking your local machines, there are that many fewer services that could potentially be compromised. Someone else will need ...


14

TL;DR It protects against having to manually configure services to only listen on localhost, as you have to manually allow them network connectivity, and it increases the effort an attacker must exert to recon your box. This means it's an effective tool both against attackers and poor configuration. Yes, you should run a firewall. Detail Ports have 2 ...


14

One can reasonably conclude (see below) that it will require some detailed analysis to determine if an arbitrary software package is vulnerable, and what configuration or mitigations may apply. Any service which performs name resolution could be at risk (patch, and be safe!). Qualys have already provided a list of software using the affected functions which ...


13

My guess is that you aren't seeing those open ports is because of the default behavior of nmap to only scan the 1.000 most commonly used ports. If you want to cover all ports you need to explicitly state that you want to scan all ports with the -p parameter. So say I want to scan from port 1 until 5037: nmap -sS 127.0.0.1 -p1-5037 To view which process ...


12

you can check the following links NMap OS Detection and Paper About Nmap Detection you will find on them different methods used for OS detection By Fyodor the Creator of Nmap and if you want to dig dive you can purchase his book from amazon. From NMap OS Detection: ...dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID ...


12

If your FTP server is always kept up to date, then usually that means there are not going to be any known exploits against that application. On the other hand, if the server is out of date then you risk robots that scan for well-known vulnerabilities that otherwise would have been fixed. If the FTP server is poorly configured, for example having a default ...


11

As far as I understand, Mosh doesn't really need a thousand ports to work; it only needs one (per client). So you can open up any single port, and tell Mosh to use it (from the manual): mosh -p 60000 my.server What is the reason for selecting the port at random? This I do not understand. [UPDATE] it does not select a random port. It searches through a set ...


11

In addition to Justin's answer about inadvertently opening up applications to be remotely accessed, remember that even if nothing is specifically listening for a connection, the operating system is ALWAYS going to be listening -- if only to route/map to the appropriate process or refuse or silently drop the packet. Therefore, the operating system is still ...


11

Services listen to ports. Web servers (a service) listen to port 80, but that's just a standard, not a hard rule. You could configure any service to listen on any port. It's not about 'special packets' it's about 'dialing the right port number' to get the service you want. If your pseudo program has a vulnerability, then it can be attacked on the port it is ...


11

White-listing is generally preferable to black-listing. If you only open the ports you actually need, and if you limit those ports to the extent possible, then you've reduced your attack surface area and limited the traffic that you need to watch. Yes, 80 and 443 can still be abused for malicious traffic. But, you're also raising the bar for attacks (at ...


Only top voted, non community-wiki answers of a minimum length are eligible