65k Open TCP Ports

Re:65k Open TCP Ports by forgotusername on Thursday October 20, 2011 @02:30AM (#3133714)

He missed port 0, although it requires special fuckery on both ends to make use of, so no big loss anyway.

[ Parent | on HN ]

Re:65k Open TCP Ports by wladimir on Thursday October 20, 2011 @06:13AM (#3134202)

He does mention port 65535 and calls it a "restricted port". Anyone have an idea why? Is it used/reserved for anything special? I have googled and that turns up only some trojans using the port...

[ Parent | on HN ]

Re:65k Open TCP Ports by sams99 on Thursday October 20, 2011 @06:14AM (#3134205)

The comment on the reason port 601 is blocked in chrome is quite funny. http://src.chromium.org/svn/trunk/src/net/base/net_util.cc

[ Parent | on HN ]

Re:65k Open TCP Ports by drzaiusapelord on Thursday October 20, 2011 @10:27AM (#3134950)

Someone was too lazy to google it:

syslog-conn 601/tcp Reliable Syslog Service syslog-conn 601/udp Reliable Syslog Service

Really? QOTD is blocked? What big threat is there from quote of the day? Did some nerd just sit down and arbitrarily pick antiquated unix services and mark them as "unsafe?"

[ Parent | on HN ]

Re:65k Open TCP Ports by kitsune_ on Thursday October 20, 2011 @07:56AM (#3134395)

for the lazy

  static const int kRestrictedPorts[] = {
  1,    // tcpmux
  ..
  587,  // stmp?
  601,  // ??
  636,  // ldap+ssl
  .. };

[ Parent | on HN ]

Re:65k Open TCP Ports by kodisha on Thursday October 20, 2011 @09:35AM (#3134725)

If I were BOFH i would allow all connections to the open.zorinaq.com

[ Parent | on HN ]

Re:65k Open TCP Ports by nl on Thursday October 20, 2011 @01:42AM (#3133610)

I never realized Chrome blocked some specific ports. Makes sense I guess - but I'll have to remember not to run a webserver on those ports.

[ Parent | on HN ]

Re:65k Open TCP Ports by evmar on Thursday October 20, 2011 @01:46AM (#3133616)

At first you might think "why should Chrome protect people who forget to firewall their intranet?" but the real problem browsers are defending against is some page doing a million <img src='http://10.0.0.1:139>; against an internal service that doesn't handle it well. (Or worse, a POST.)

(PS: HN shows extra characters than what I typed in that HTML. Might be an XSS vulnerability in there.)

[ Parent | on HN ]

Re:65k Open TCP Ports by jdukes on Thursday October 20, 2011 @03:23AM (#3133832)

This actually also has to do with cross protocol attacks. http://i8jesus.com/?p=75

[ Parent | on HN ]

Re:65k Open TCP Ports by maximusprime on Thursday October 20, 2011 @03:57AM (#3133920)

There was an attack last year on freenode which worked like this... javascript did an automatic POST to irc.freenode.net:6667 with form data that included IRC commands to spam channels etc.

Unfortunately at the time their ircd didn't care about the 'POST / HTTP headers', and lovingly accepted the spam.

[ Parent | on HN ]

Re:65k Open TCP Ports by rwmj on Thursday October 20, 2011 @03:38AM (#3133872)

Firefox is blocking port 25 with a warning message.

[ Parent | on HN ]

Re:65k Open TCP Ports by Luyt on Thursday October 20, 2011 @04:27AM (#3133977)

"This address is restricted

This address uses a network port which is normally used for purposes other than Web browsing. Firefox has canceled the request for your protection. "

This 'port banning' is described in http://www-archive.mozilla.org/projects/netlib/PortBanning.h..., and the page at http://agiletesting.blogspot.com/2008/09/getting-around-fire... describes how you can use about:config to disable the blocking:

"1) go to about:config in the Firefox address bar

2) right click, choose new->string

3) enter the name network.security.ports.banned.override and the value '1-65535' (without the quotes) "

I tried it, and it worked: http://open.zorinaq.com:25/

[ Parent | on HN ]

Re:65k Open TCP Ports by TMK on Thursday October 20, 2011 @07:29AM (#3134331)

I wrote a quick script to do port testing with the server.

This script should work with any system that has curl with some little modifications, but I've only tested it in fedora 15. You can find it from codepad and the script will run over all ports if the port range has not been specified.

The first terminal argument will be the range start and second argument will be the range end. For example: php port_test.php 1 24 will run the test on ports 1-24

http://codepad.org/8O1WDywv

[ Parent | on HN ]

Re:65k Open TCP Ports by dave1010uk on Thursday October 20, 2011 @08:20AM (#3134459)

You can use bash expansion to do this:

    curl http://open.zorinaq.com:{100..200}/

Unfortunately the server doesn't send back the port number in the HTML. Use this to see which port numbers you can connect to:

    curl -v http://open.zorinaq.com:{100..600}/ 2>&1 | grep 'Connected to'

[ Parent | on HN ]

Re:65k Open TCP Ports by TMK on Thursday October 20, 2011 @08:25AM (#3134474)

Oh yes! I forgot totally about bash expansion. :)

[ Parent | on HN ]

Re:65k Open TCP Ports by chaosfox on Thursday October 20, 2011 @09:31AM (#3134706)

and a perl one-liner, just for the sake of it:

   perl -MLWP::Simple=\$ua -le 'print"port $_ - ".$ua->get("http://open.zorinaq.com:$_")->status_line for 1..65535'

[ Parent | on HN ]

Re:65k Open TCP Ports by cdine on Thursday October 20, 2011 @11:26AM (#3135265)

For some time I've ran a box with PF forwarding all TCP ports to an SSH server. That plus a simple nmap connect scan has proved handy for countless annoying networks that try to block "common" ports, poorly configured captive portal networks, etc. It's amazing how many "restricted" networks allow TCP 1, 53, 1723, 8080, and a few others out to the open net.

[ Parent | on HN ]

Re:65k Open TCP Ports by screwt on Thursday October 20, 2011 @10:11AM (#3134876)

Would be nice to show the port you've accessed in the body (useful for scripting etc).

[ Parent | on HN ]

Re:65k Open TCP Ports by 16s on Thursday October 20, 2011 @12:38PM (#3135632)

Nice site. You can do the same thing by running tcpdump on a remote host and nmapping every port. You can do this your self or work with a friend.

Cool site nonetheless. Makes it easy for non-techies to do.

[ Parent | on HN ]

Re:65k Open TCP Ports by Chlorus on Thursday October 20, 2011 @04:58AM (#3134042)

Been looking for something like this for a very, very, long time. Certainly makes egress filter testing a hell of a lot easier. Thank you!

[ Parent | on HN ]

Re:65k Open TCP Ports by amalag on Thursday October 20, 2011 @11:26AM (#3135263)

Dude, slap some Google ads on this, is great idea

[ Parent | on HN ]

Re:65k Open TCP Ports by ww520 on Thursday October 20, 2011 @02:06AM (#3133657)

Port 79 doesn't work. What port is that?

[ Parent | on HN ]

Re:65k Open TCP Ports by mbreese on Thursday October 20, 2011 @02:09AM (#3133663)

http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_number...

Port 79: Finger

[ Parent | on HN ]

Re:65k Open TCP Ports by naz on Thursday October 20, 2011 @05:57AM (#3134168)

Maybe you can thank rtm for this port being banned

[ Parent | on HN ]

Re:65k Open TCP Ports by Confusion on Thursday October 20, 2011 @02:07AM (#3133659)

  grep '\b79' /etc/services
  finger		79/tcp

[ Parent | on HN ]

Re:65k Open TCP Ports by mrb on Thursday October 20, 2011 @02:53AM (#3133764)

You may prefer: grep -w 79 /etc/services

[ Parent | on HN ]

Re:65k Open TCP Ports by zwp on Thursday October 20, 2011 @03:37AM (#3133868)

    getent services 79

(Advantage is that getent will follow your nsswitch.conf configuration to find your actual service database).

[ Parent | on HN ]