Hello, guys, and welcome to another video on this chapter.
One of the checks that should be standard practice, in my opinion,
involves finding out if an app uses non-standard security ports and protocols.
Either you are on the defender side or the attacker side.
However, there are thousands of ports and
quite a few protocols to look at in this video.
We're going to learn how to check out sneaky non-standard port use.
In non-standard port just means a service running on a port other than its default.
This is usually how a is defined by default and non-standard
port just means a service running on a port other than its default.
The IANA and port Numbers Registry that you can find in the link provided in this
slide, you can check the standard port and non-standard port just means service
running on the port other than its default services use some default standard
default ports that are usually defined by the IANA port number registry
that, you can actually check out on the link provided in this lesson.
Running a service on a non-standard port
doesn't really mean particularly something specific.
Security wise, it may reduce the amount of
noise that a defender has to deal with in terms of automated scanning on the
Internet where but usually target common standards port for vulnerabilities moving
from SSH 22 to, for example, let's say five five five two two might
reduce the number of drive by Brute-force attempt.
So either you are on the defendant's side or the Attack a side.
In order to find all the services running
on the system, one can use nmap or a similar tool.
And for example, you can use the commond nmap space dash s the capital
S space dash A space dash Pn space dasht T4 space p1 dash
sixty five thousand five hundred thirty five space the target
iP, so let's break down a little bit, this command, the dash sS tells nmap to perform
a TCP, SYN Scan the dash A, enables a range of options related to
operating system detection, service detection, Script scanning. Dash Pn tells
nmap not to use a ICMP ping to check if the host is up.
Dash Tfour sets the speed of the scan the
usually the valid arguments are zero to five.
Usually the argument are from zero to five
dash p1 to sixty five thousand five hundred thirty five.
That's the port range.
So somebody is handing down both standard and non-standard ports.
This is the only way to cover everything.
The results of this command should
show you any ports that are open and what services are running them from there.
It's an open question as to what protocols are considered to petition a potential
having of an Attack SSH to Internet might be useful, but unless they are weak,
but unless they use and weak username and password, it's probably not interesting.
They might run an HTTP Server on a non standard port with a vulnerable, with a
vulnerable web application being served and that might be of interest.
So the possibilities are quite endless.
You can use Wireshark for that matter, once you've identified port services that
are running them to record any kind of sneaky traffic.
But utilizing the display filter section of Wireshark after you have captured all
the desired traffic you can focus on, let's say it's say it's traffic, for
example, by typing Ssh in your display filter.
And this will filter out all the unwanted
results from your huge traffic capture file and show you only the SSH traffic,
you can perform the same for any other service that the traffic you would like to
respect from, or you can use specific ports
that services are running on by utilizing, let's say, the filter TCP dot port
equals 80, like we discussed in the previous lesson.
Generally, you are not introducing a new
vulnerability by running a Server on another port.
Software will behave the same way regardless of what port it listens to.
Unless, of course, there is a
vulnerability in the code that passes and Switch come and say it's custom port
though you may find sometimes that your clients cannot connect to your Server
because the Firewall or Intrusion Detection System network.
If not, this is bad.
Traffic expects the right protocol on
well known ports and if you are in an enterprise
environment, those firewalls and intrusion detection systems will likely be flooded
with false positives, making it harder to detect legitimate threats among the noise.
And the lesson may be hid not name
security, were not things that they have protected themselves from ftp
vulnerabilities but close enough ports 2021.
And you are open ftp vulnerabilities but put an ftp
Server on port 22, let's say, which is open generally to do the world.
The FTP Software isn't more vulnerable
here, but the system as a whole may be. Take an example, you have the Website
with the vulnerability that allows them to take control of your Apache.
engine makes Webuser and SSH Server has an ability that can crush it.
The web user can cross the SSH Server that start their own.
They want user and crush the SSH Server and start their own.
And because it started PORT,
let's say above one thousand twenty four, nothing will prevent it.
As soon as you can send your Password.
SSH Server and don't like it, nor should the ignore
privileges the Attack you can gain whatever privileges you have as well.
In general, I will call that a high security vulnerability.
But if an attacker can gain access to non user Router on your server and your
server is expected to run its services on port
above one thousand twenty four, let's say it can be an unnecessary weakness.
The non-standard ports are general targets or exploitations.
It may not be so desired or high priority, but it's still a target for exploitation.
It is like locking the front door of your
house, but leaving the windows open in general, locking the front door of your
house, but leaving the windows open is in an security started to.
That's why it's cyber. Criminals are targeting a range of
non-standard ports to ensure the payloads can be deployed undetected.
In a recent research, nineteen point two or four Malware Attack came across
non-standard ports in the year or the year two thousand eighteen,
which signifies a range of one point five percent compared to 2017.
Most organizations are safeguarding this sector because of performance or cost
concerns, leaving millions of Attack unchecked.
So that was it for the video.
I hope it was quite informative for you.
And when you're ready, you can go ahead and click on the next video.
What are you going to learn?
How to investigate Lost packets with Wireshark.