Discovering Open Ports

Discovering open ports is the foundation of network enumeration. Open ports reveal which services are running, which protocols are exposed, and how attackers can communicate with the target system. Every open port represents an entry point, and misconfigured or outdated services often lead to remote code execution, credential leaks, or full compromise. This chapter focuses entirely on practical, hands-on techniques using both local and remote enumeration tools.

Understanding the Importance of Open Port Discovery

Open ports expose services listening on the network. Pentesters analyze them to:

• Identify running services and their versions

• Map the attack surface

• Discover administrative interfaces

• Reveal internal-only services accidentally exposed

• Detect backdoors and malicious listeners

• Determine reachable attack vectors

• Identify pivoting opportunities

Accurate port discovery ensures no service remains hidden from assessment.

Local Enumeration of Open Ports (Attacker Has Shell on Target)

If you gain a local shell on the target, you can enumerate open ports internally—often revealing services not exposed externally.

List listening TCP ports:

ss -tln

List listening UDP ports:

ss -uln

View processes linked to ports:

ss -tulnp

Example output:

tcp LISTEN 0 128 0.0.0.0:22   users:(("sshd",pid=727))
tcp LISTEN 0 128 127.0.0.1:3306 users:(("mysqld",pid=900))
tcp LISTEN 0 80 0.0.0.0:80    users:(("apache2",pid=1100))

Interpretation:

• 22 → SSH exposed externally

• 80 → Web server exposed externally

• 3306 → MySQL bound to localhost only (internal attack path)

Check binding addresses:

• 0.0.0.0 → exposed on ALL interfaces

• 127.0.0.1 → internal only

• 192.168.x.x → internal network exposure

Detecting Hidden or Malware Ports

Search for malware/backdoors:

ss -tulpn | grep -E "4444|1337|12345|9001"

Look for suspicious bindings:

ss -tulpn | grep LISTEN | grep -vE "ssh|http|https|mysql|nginx|apache"

Any unknown service listening on a high port must be investigated.

Remote Port Scanning with Nmap (Primary Tool)

Nmap is the most powerful port discovery tool.

Basic TCP scan:

nmap -sT <target>

Fast scan of top ports:

nmap -F <target>

Stealth SYN scan:

nmap -sS <target>

UDP scan:

nmap -sU <target>

Discover all TCP ports:

nmap -p- <target>

Nmap service detection:

nmap -sV <target>

OS detection included:

nmap -A <target>

Example output:

22/tcp open ssh
80/tcp open http
3306/tcp filtered mysql

Interpretation:

• open → reachable

• filtered → blocked by firewall

• closed → no service present

Identifying Port States (Practical Understanding)

Nmap states you must understand:

• open → service is listening

• closed → host reachable but no listener

• filtered → firewall blocks it

• unfiltered → accessible but state cannot be determined

• open|filtered → uncertain (often UDP)

For pentesting, open and open|filtered require deeper investigation.

Banner Grabbing (Manual & Automated)

Banner grabbing reveals service identity.

Manual:

nc <target> <port>

Example:

nc 192.168.1.10 22
SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.5

HTTP example:

nc 192.168.1.10 80
GET / HTTP/1.1

Automated banner grabbing:

nmap -sV --version-light <target>

Discovering Web Services on Unusual Ports

Scan for HTTP servers anywhere:

nmap -p- -sV --open <target> | grep http

Check common alternative ports:

nmap -p 8080,8443,8000,8888 <target>

Many admin panels and frameworks run on these ports.

Scanning for SSL/TLS Services

Find SSL-based services:

nmap -sV --script ssl-cert <target>

View certificate details:

openssl s_client -connect <target>:443

UDP Service Discovery (Practical)

UDP is harder to scan due to no handshake.

Common UDP ports:

nmap -sU --top-ports 50 <target>

Specific services:

• 53 (DNS)

• 161 (SNMP)

• 137,139,445 (NetBIOS/SMB)

• 500 (IPsec)

• 67/68 (DHCP)

Example SNMP probe:

snmpwalk -v2c -c public <target>

Scanning with Masscan (High-Speed Internet-Scale Scanning)

Masscan is extremely fast.

Scan all ports:

masscan -p1-65535 <target> --rate 50000

Then enumerate interesting ports with Nmap.

Identifying Services with Script-Based Scanning

Nmap NSE scripts identify deeper vulnerabilities.

Example:

nmap --script=vuln <target>

Detect default credentials:

nmap --script=auth <target>

Scan for SMB vulnerabilities:

nmap --script=smb-vuln* <target>

Internal vs External Port Discovery

Remote view of ports:

nmap <target>

Local-internal view (if shell obtained):

ss -tulpn

Compare outputs to detect:

• Firewalls

• Hidden internal services

• Privilege-escalation targets

Example:

• External scan shows ports 22 and 80

• Internal ss shows MySQL on 3306
  → Attack MySQL locally via privilege escalation.

Discovering Firewall Rules with Port Scanning Patterns

If many ports show as filtered, likely a firewall is active.

Scan with decoys:

nmap -D RND:10 -sS <target>

Scan with fragmentation:

nmap -f <target>

Bypass simple firewalls with:

nmap -sA <target>

Practical Exploitation Scenarios

Scenario 1: Admin Panel on Hidden Port

Discover:

8080/tcp open http-proxy

Visit the port, find admin interface, brute-force login.

Scenario 2: Internal Database Exposure

Local-only listener:

127.0.0.1:3306

Exploit via local privilege escalation and database takeover.

Scenario 3: SNMP Open

161/udp open snmp

Use:

snmpwalk -v2c -c public <target>

Extract credentials and system secrets.

Scenario 4: Misconfigured SSH on High Port

2222/tcp open ssh

Attackers often hide SSH here; pentesters must find it.

Scenario 5: Malware Backdoor

4444/tcp open unknown

Check process owner:

ss -tulpn | grep 4444

Intel Dump

• Open port enumeration maps attack surface

• Use ss -tulpn for local discovery

• Use Nmap (-sS, -sV, -A, -p-) for remote scanning

• Masscan provides ultra-fast scanning

• Banner grabbing reveals service identity

• UDP scanning finds hidden services (DNS, SNMP, DHCP)

• Internal-only services are privilege escalation targets

• Compare internal vs external view to detect firewalls

• Nmap NSE scripts discover vulnerabilities and auth issues

• Ports on unusual numbers often hide admin panels

• Malware leaves open high-numbered ports

• Misconfigured services on 0.0.0.0 expose the entire network