Skip to main content
Share Your Experience: Take the 2024 Developer Survey
198 votes
Accepted

Is it theoretically possible to deploy backdoors on ports higher than 65535?

No, the port number field in a TCP header is technically limited to 2 bytes. (giving you 2^16=65536 possible ports) If you alter the protocol by reserving more bits for higher ports, you're violating ...
Arminius's user avatar
  • 44.8k
63 votes

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
forest's user avatar
  • 66.8k
62 votes

Is it safer to use a port other than 21 for FTP?

It is not safe to use ftp over any port. Those who have a malicious intent to get in your network or system will not scan your system for port 21 but for all ports, and will figure the other port in ...
yetdot's user avatar
  • 706
62 votes
Accepted

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
phyrfox's user avatar
  • 5,724
54 votes
Accepted

Why do hackers scan for open ports?

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs ...
Philipp's user avatar
  • 49.4k
48 votes
Accepted

I have found ports on my Samsung smart tv running a display service. What can I do with it?

While this isn't strictly a security question, I'm unsure if the Stack Exchanges for Super User or Networking would take this, so I'll just answer it quickly: Depending on your options, nmap will ...
Tobi Nary's user avatar
  • 14.4k
43 votes

How wise is it to use a tool for portspoofing at your server to confuse attackers?

Multiple problems here. Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence. You're burning CPU ...
Ryan Gooler's user avatar
41 votes
Accepted

Why is it better to use ports 20 and 53 as source ports when portscanning?

You guessed correctly. According to the Nmap Reference Guide: --source-port <portnumber>; -g <portnumber> (Spoof source port number) One surprisingly common misconfiguration is to trust ...
A. Darwin's user avatar
  • 3,567
36 votes

Is it safer to use a port other than 21 for FTP?

The reason FTP is generally considered insecure is because it is not encrypted, which means that if someone is sniffing traffic anywhere in the network path, then everything traversing it can be read. ...
TTT's user avatar
  • 9,222
28 votes

Is it theoretically possible to deploy backdoors on ports higher than 65535?

No, it's that number because the TCP field for that is only 16 bits long (65536, but starting at 0), so it is fundamentally impossible to communicate a higher port than 65535 This post has a really ...
J.A.K.'s user avatar
  • 4,853
25 votes

Is it theoretically possible to deploy backdoors on ports higher than 65535?

If you rebuilt the TCP/IP stack locally on the machine, would the overall concept not work due to how the RFC 793 - Transmission Control Protocol Standard works as mentioned below in some of the ...
LSerni's user avatar
  • 22.8k
19 votes
Accepted

What are non-standard ports and protocols

A non-standard port just means a service running on a port other than its default, usually as defined by the IANA port numbers registry. Running a service on a non-standard port doesn't really mean ...
Polynomial's user avatar
  • 135k
18 votes
Accepted

Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners

How could a IANA reserved port(tcp/0) handle traffic? It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are ...
ximaera's user avatar
  • 3,486
14 votes
Accepted

Security implications of granting non-root access to privileged ports (<1024)

When you're using rootless Docker/Podman, the risks of allowing users to bind ports < 1024, generally depend on what else is happening on the system. TBH the old restriction on low ports doesn't ...
Rory McCune's user avatar
  • 62.3k
12 votes

Is it safer to use a port other than 21 for FTP?

If your FTP server is always kept up to date, then usually that means there are not going to be any known exploits against that application. On the other hand, if the server is out of date then you ...
700 Software's user avatar
12 votes

What are the best pratices to avoid my server being port scanned

Portknocking Portknocking is a method to open ports that the firewall normally keeps closed by executing a series of connection attempts (knocks) to other ports. Upon the valid sequence of port knocks,...
Joe's user avatar
  • 2,764
12 votes
Accepted

Connection to ports 2000 and 5060 successful despite filtering

There is something between the scanner and the target that is responding on behalf of the target, spoofing its source address so as to appear to be the target itself. When you ran the Nmap scan as ...
bonsaiviking's user avatar
  • 11.6k
12 votes

Security implications of granting non-root access to privileged ports (<1024)

It depends on your system. If it's a multi-user system with multiple users able to run docker, you may fall victim to a race attack, where a malicious docker container is started when your legitimate ...
vidarlo's user avatar
  • 16.5k
10 votes

Why is UDP port scanning slower than TCP port scanning?

The difference is in the very nature of the two protocols. TCP is a connection-oriented protocol. This means that systems must establish and confirm a stable connection - for TCP, the process is ...
Iszi's user avatar
  • 27.1k
10 votes
Accepted

Can nmap take a list of ports to scan from a file?

Not by itself, no. But with some quick scripting you can. For example, on *nix systems: nmap -p `cat ports.list` ... This would allow you to maintain a list of ports in a file in a CSV format. If ...
h4ckNinja's user avatar
  • 3,056
9 votes

How wise is it to use a tool for portspoofing at your server to confuse attackers?

I assume the effectiveness will be very limited. First of all, exploiting port scanning tools will rarely be useful because most pentesters will use VMs and other confined environments when ...
Elias's user avatar
  • 1,980
9 votes
Accepted

Multiple Open ports on a server, is that safe?

There are a lot of misunderstandings and assumptions in your question, but I will try to address them. First, you are scanning a domain (I assume from the Internet). Just because nmap shows them as ...
schroeder's user avatar
  • 131k
8 votes

Creating port-specific SSH authentication for the same user

In fact match expression must be on the same first line. So this should work as expected in /etc/ssh/sshd_config: Match User XX LocalPort 22 PasswordAuthentication no RSAAuthentication yes ...
Yves Martin's user avatar
8 votes

Can a hacker hack into port 80?

A port itself cannot be hacked, rather, it comes down to if the service running on that port contains any vulnerabilities. If you're running a web service on port 80 that contains no known ...
Henry F's user avatar
  • 626
8 votes
Accepted

Ports Showing Closed/Filtered in Nmap Scans

To avoid 65K+ lines of mostly-useless output, Nmap collapses most "uninteresting" results into a line that says something like "Not shown: 65530 filtered ports." Open ports are never collapsed this ...
bonsaiviking's user avatar
  • 11.6k
8 votes

Is it security risk to host CS:GO server on my PC?

The biggest risk is probably a 0-day or simply an unpatched vulnerability in the server software of CS:GO. Against a 0-day you are rather helpless. You can give the user running the CS:GO process as ...
Demento's user avatar
  • 7,455
8 votes
Accepted

What is insecure about the "insecure" option of NFS exports?

NFS trusts the client to provide its user ID. If the client says "I am user ID 1234", then the server assumes it's being accessed by user 1234. (Root is often disabled though) Ports below ...
Quitting Due To Antisemitism's user avatar
7 votes

Does an open port with no service listening on it pose a risk?

In nmap terminology, an "open" port is usually the port where a service is bound on, and listening; otherwise the port is not open. However, it seems like you are asking about having a port open on ...
George Y.'s user avatar
  • 3,534
7 votes

Nmap - Intense vs Quick result

First, let's correct some assumptions and terminology which will make understanding the results a lot easier: The -F option is a "quick" scan because it scans only 100 ports. It is the equivalent of -...
bonsaiviking's user avatar
  • 11.6k
7 votes

Minimal usage in Windows 10 justify filtering all ports besides 22, 80, 443?

There's a couple of different components to the answer: I think you have a misunderstanding of ingress vs egress and stateful firewalls. Most stateful firewalls (IPTables configured with ufw, the ...
David's user avatar
  • 16.1k

Only top scored, non community-wiki answers of a minimum length are eligible