Unit 7: The network from the host · Lesson 1 of 7 · 15 min
Listening ports
Every listening port is a door. Find them all and note who can knock.
mission
- You are
- You are mapping web01's attack surface.
- Situation
- Anything the server offers to the network is a process listening on a port. Every one needs an owner and a reason.
- Goal
- List every listening TCP port and whether it faces the network or only the machine.
- Hand in
- A list of ports, addresses and questions.
List the listeners
ss -tln
State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0 4096 127.0.0.1:7681 0.0.0.0:*
LISTEN 0 5 127.0.0.1:8081 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 1 0.0.0.0:4444 0.0.0.0:*
LISTEN 0 4096 0.0.0.0:8080 0.0.0.0:*
you should see -t TCP, -l listening, -n numbers instead of names.
ss- Lists network sockets, such as listening ports and open connections. Built into Linux.
Make it a clean list
ss -tlnH | awk '{print $4}' | sort
0.0.0.0:22
0.0.0.0:4444
0.0.0.0:8080
127.0.0.1:7681
127.0.0.1:8081
you should see 8080 and 7681 belong to the lab and carry this terminal. 22 is SSH. That leaves 4444 facing the network and 8081 local only.
awk- Splits each line into fields and prints or counts the ones you ask for. Built into Linux and macOS.
sort- Sorts lines of text. Built into Linux and macOS.
Ports worth knowing
| Command | What it does |
|---|---|
22 | SSH |
80, 443 | Web, plain and encrypted |
3306, 5432 | MySQL, PostgreSQL. Never public |
0.0.0.0 | Every interface: reachable from the network |
127.0.0.1 | Loopback: only this machine |
UDP and one port
-u lists UDP. A filter in brackets narrows to one port.
ss -uln State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess ss -tln '( sport = :4444 )' State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 1 0.0.0.0:4444 0.0.0.0:*
you should see No UDP listeners, and 4444 open on every interface.
What a defender takes away
- 1ss -tln lists listening TCP ports.
- 20.0.0.0 faces the network, 127.0.0.1 does not.
- 3Unexplained high ports go on the list.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.