Unit 7: The network from the host · Lesson 1 of 7 · 15 min
Listening ports
Every listening port is a door. Find them all and note who can knock.
mission
- You are
- You are mapping web01's attack surface.
- Situation
- Anything the server offers to the network is a process listening on a port. Every one needs an owner and a reason.
- Goal
- List every listening TCP port and whether it faces the network or only the machine.
- Hand in
- A list of ports, addresses and questions.
List the listeners
ss -tln
State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0 4096 127.0.0.1:7681 0.0.0.0:*
LISTEN 0 5 127.0.0.1:8081 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 1 0.0.0.0:4444 0.0.0.0:*
LISTEN 0 4096 0.0.0.0:8080 0.0.0.0:*
you should see -t TCP, -l listening, -n numbers instead of names.
Make it a clean list
ss -tlnH | awk '{print $4}' | sort
0.0.0.0:22
0.0.0.0:4444
0.0.0.0:8080
127.0.0.1:7681
127.0.0.1:8081
you should see 8080 and 7681 belong to the lab and carry this terminal. 22 is SSH. That leaves 4444 facing the network and 8081 local only.
Ports worth knowing
| Command | What it does |
|---|---|
22 | SSH |
80, 443 | Web, plain and encrypted |
3306, 5432 | MySQL, PostgreSQL. Never public |
0.0.0.0 | Every interface: reachable from the network |
127.0.0.1 | Loopback: only this machine |
UDP and one port
-u lists UDP. A filter in brackets narrows to one port.
ss -uln State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess ss -tln '( sport = :4444 )' State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 1 0.0.0.0:4444 0.0.0.0:*
you should see No UDP listeners, and 4444 open on every interface.
What a defender takes away
- 1ss -tln lists listening TCP ports.
- 20.0.0.0 faces the network, 127.0.0.1 does not.
- 3Unexplained high ports go on the list.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.