198
votes
Accepted
Is it theoretically possible to deploy backdoors on ports higher than 65535?
No, the port number field in a TCP header is technically limited to 2 bytes. (giving you 2^16=65536 possible ports)
If you alter the protocol by reserving more bits for higher ports, you're violating ...
- 44.6k
64
votes
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
- 66.4k
63
votes
Is it safer to use a port other than 21 for FTP?
It is not safe to use ftp over any port. Those who have a malicious intent to get in your network or system will not scan your system for port 21 but for all ports, and will figure the other port in ...
- 706
63
votes
Accepted
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
- 5,734
55
votes
How do you deal with massive port scans?
I ignore them. And if you have a reasonable security posture, you should too.
Your servers should have no ports open to the general public other than those that you use to serve the general public.
...
- 83.2k
54
votes
Accepted
Why do hackers scan for open ports?
To run an exploit, an attacker needs a vulnerability.
To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs ...
- 49.3k
48
votes
Accepted
I have found ports on my Samsung smart tv running a display service. What can I do with it?
While this isn't strictly a security question, I'm unsure if the Stack Exchanges for Super User or Networking would take this, so I'll just answer it quickly:
Depending on your options, nmap will ...
- 14.4k
44
votes
How wise is it to use a tool for portspoofing at your server to confuse attackers?
Multiple problems here.
Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence.
You're burning CPU ...
- 759
41
votes
Accepted
Why is it better to use ports 20 and 53 as source ports when portscanning?
You guessed correctly.
According to the Nmap Reference Guide:
--source-port <portnumber>; -g <portnumber> (Spoof source port number)
One surprisingly common misconfiguration is to trust ...
- 3,592
36
votes
Is it safer to use a port other than 21 for FTP?
The reason FTP is generally considered insecure is because it is not encrypted, which means that if someone is sniffing traffic anywhere in the network path, then everything traversing it can be read. ...
- 9,192
28
votes
Is it theoretically possible to deploy backdoors on ports higher than 65535?
No, it's that number because the TCP field for that is only 16 bits long (65536, but starting at 0), so it is fundamentally impossible to communicate a higher port than 65535
This post has a really ...
- 4,823
25
votes
Is it theoretically possible to deploy backdoors on ports higher than 65535?
If you rebuilt the TCP/IP stack locally on the machine, would the
overall concept not work due to how the RFC 793 - Transmission Control
Protocol Standard works as mentioned below in some of the ...
- 22.8k
23
votes
Security risk of opening port 111 (rpcbind)?
If you expose this service to the internet, everybody can query this information without having to authenticate. It can be useful to attackers to know what you have running.
Also, the RPC service has ...
- 1,321
19
votes
How do you deal with massive port scans?
I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs.
For example, I created an AWS app that turns up ...
- 1,125
19
votes
Accepted
What are non-standard ports and protocols
A non-standard port just means a service running on a port other than its default, usually as defined by the IANA port numbers registry.
Running a service on a non-standard port doesn't really mean ...
- 135k
18
votes
Accepted
Tons of vulnerabilities are found on tcp/0 port using vulnerability scanners
How could a IANA reserved port(tcp/0) handle traffic?
It can. Generally, TCP (or UDP) port 0 being in a reserved state doesn't mean it can't be used in practice. Though the way Berkeley sockets are ...
- 3,456
14
votes
Accepted
Security implications of granting non-root access to privileged ports (<1024)
When you're using rootless Docker/Podman, the risks of allowing users to bind ports < 1024, generally depend on what else is happening on the system.
TBH the old restriction on low ports doesn't ...
- 62.1k
13
votes
Using non standard port numbers
If the port is accessible from the outside, it cuts down on the number of random scan: most of the simplest automated scanners will simply check the default port.
However, it can also induce a false ...
- 18.7k
12
votes
Is it safer to use a port other than 21 for FTP?
If your FTP server is always kept up to date, then usually that means there are not going to be any known exploits against that application. On the other hand, if the server is out of date then you ...
- 14k
12
votes
What are the best pratices to avoid my server being port scanned
Portknocking
Portknocking is a method to open ports that the firewall normally keeps closed by executing a series of connection attempts (knocks) to other ports. Upon the valid sequence of port knocks,...
- 2,764
12
votes
Security implications of granting non-root access to privileged ports (<1024)
It depends on your system.
If it's a multi-user system with multiple users able to run docker, you may fall victim to a race attack, where a malicious docker container is started when your legitimate ...
- 15.4k
11
votes
Using non standard port numbers
It slightly offers some benefits. This is so called security through obscurity. There are many scanners active on the internet that have a default set of ports that they scan (like 21 (FTP), 22 (SSH), ...
- 410
11
votes
Accepted
Connection to ports 2000 and 5060 successful despite filtering
There is something between the scanner and the target that is responding on behalf of the target, spoofing its source address so as to appear to be the target itself. When you ran the Nmap scan as ...
- 11.6k
10
votes
Why is UDP port scanning slower than TCP port scanning?
The difference is in the very nature of the two protocols.
TCP is a connection-oriented protocol. This means that systems must establish and confirm a stable connection - for TCP, the process is ...
- 27.1k
10
votes
Accepted
Can nmap take a list of ports to scan from a file?
Not by itself, no. But with some quick scripting you can.
For example, on *nix systems:
nmap -p `cat ports.list` ...
This would allow you to maintain a list of ports in a file in a CSV format.
If ...
- 3,036
9
votes
How wise is it to use a tool for portspoofing at your server to confuse attackers?
I assume the effectiveness will be very limited.
First of all, exploiting port scanning tools will rarely be useful because most pentesters will use VMs and other confined environments when ...
- 1,955
9
votes
Accepted
Multiple Open ports on a server, is that safe?
There are a lot of misunderstandings and assumptions in your question, but I will try to address them.
First, you are scanning a domain (I assume from the Internet). Just because nmap shows them as ...
- 128k
8
votes
Creating port-specific SSH authentication for the same user
In fact match expression must be on the same first line. So this should work as expected in /etc/ssh/sshd_config:
Match User XX LocalPort 22
PasswordAuthentication no
RSAAuthentication yes
...
- 221
8
votes
Can a hacker hack into port 80?
A port itself cannot be hacked, rather, it comes down to if the service running on that port contains any vulnerabilities. If you're running a web service on port 80 that contains no known ...
- 626
8
votes
Accepted
Ports Showing Closed/Filtered in Nmap Scans
To avoid 65K+ lines of mostly-useless output, Nmap collapses most "uninteresting" results into a line that says something like "Not shown: 65530 filtered ports." Open ports are never collapsed this ...
- 11.6k
Only top scored, non community-wiki answers of a minimum length are eligible