Printable View
I guess we all know the standard services 80 http, 21 ftp..... blablabla...
The question that I have is what are the standard outbound ports for somthing so diverse as a browser. (i.e. IE ;) )
does it make the requests from the same socket for same service or does it vary..
does it make reqests for different services from different sockets (http/ftp) ...
Ports for browsers are usually anything over 1024. Traditionally, any client applications will be found above 1024. Using netstat can help you see which port your browser is using at present. Port numbers will vary from application to application and no two applications should be using the same port (AFAIK).
Hope that helps.
Yes, but you will see different protocols accepted on the same port. i.e. TCP and UDP will both be accepted on port 445 for CIFS.Quote:
Port numbers will vary from application to application and no two applications should be using the same port (AFAIK).
does browser make the request always from the same port... or do the ports vary
what i'm trying to understand is ... how can a ssh tunnel make reqest on behalf of a browser... i would understand if it would be a special proxy server which is programed to behave like a server ... but ssh is basically a telnet...
do web servers expect incoming from a specified port or it really doesn't matter
The browser doesn't care about the source port beyond keeping track of info to send back to the client. The SSH Tunnel makes the request because of the destination port it goes to, not where it comes from. The web server just responds to requests made at port 80 or whatever port it is set to listen to.
Each connection is established with a different source port. To prove this, open two browsers and point them both to AO (or any site of your choice). Drop to a command prompt and type netstat -an. You will see high port connections from your machine to port 80 on both instances of your browser connections to AO.
I think it would be better proved to open one do netstat close it then do the other. Because if you do them at the same time it has to be a different port so that doesn't prove anything.Quote:
Each connection is established with a different source port. To prove this, open two browsers and point them both to AO (or any site of your choice). Drop to a command prompt and type netstat -an. You will see high port connections from your machine to port 80 on both instances of your browser connections to AO.
The client side will usually pick a random port above 1024 and it usually is a lot higher. You can actually force a client to use a particular client side port. I just read about it the other day but it was more of a pain in the ass then it was worth. I cant remeber what it was called off hand but if I remember ill post it up here
Er.... This thread doesn't seem to be going the right direction..... Let me have a go...... :D
The Original question was:-
I see three parts:-Quote:
The question that I have is what are the standard outbound ports for somthing so diverse as a browser. (i.e. IE )
does it make the requests from the same socket for same service or does it vary..
does it make reqests for different services from different sockets (http/ftp) ...
1. what are the standard outbound ports for somthing so diverse as a browser.
You determine the outbound port of your browser by the letters you type before the "://" portion of the url. Thus hhtp forces a request on port 80, https forces on port 443 and ftp forces a request on 21..... The source port, (the one your browser uses to separate sessions is "randomly" picked at the initiation of the session and is above 1024)
2. does it make the requests from the same socket for same service or does it vary..
The common services are always found on the same ports as far as your browser is concerned. However, if the remote server uses a different port for a common service you can force the browser to make it's request on that port by adding ":8080" at the end of the url. So a request to mydomain.com that runs it's web server on port 8000 would look like this -
http://www.mydomain.com:8000
I believe you could actually drop the http:// portion though IE will add it back in so I can't test that from here. The www.mydomain.com is still required for DNS resolution.... but if you knew the IP you could type 123.123.123.123:8000 and arrive at the same place.
Again, the source port is randomly selected above 1024 for each session.
3. does it make reqests for different services from different sockets (http/ftp) ...
This question is really answered by the two answers above but for clarification..... By convention that same services are carried by the same ports internet-wide so the answer to the question is yes. The disclaimer on that is in the answer to the second question where, if a provider puts a well known service on a non-standard port he needs to "advertize" the fact by adding the ":8000" to any links he puts anywhere.
Now this does have some useful security applications. It doesn't mean that you can give up securing these services that you "hide" but it does make the job of footprinting that little bit more difficult, time consuming and risky for the cracker.
You can "hide" common services on unusual ports and still have it accessible to the whole world, (you are unable to specify the IP addresses that can connect because your workforce is too mobile and never get the same IP address), but hard to find. For example you can have a terminal services connection open to the world on port 6134 instead of 3389 where it would usually be, (it's a registry change on the server and an export, edit, import task on the client to change the port). Now, if Joe S. Kiddie wants to scan for term servers 'cos he has a new "sploit" he's going to scan your netblock for port 3398. Now, Joe is smart, and knows that to avoid the default portscan detection of Snort he needs a scan rate of less than 4 connections in 2 seconds so, to play it safe he runs his scan rate at 1/sec - equating to 4 mins 15 seconds to scan your netblock - and find nothing!!!!! To find it he must maintain the same scan rate but cover 254 x 65535 = 16645890 = 277431.5 minutes = 4623 hours = 192.33 days to scan your network and get a reply from your terminal server. (Remember, most scanners are multithreaded so you can't say they would get to the port after only 6134 events per IP address).
This doesn't mean that you can "hide" a service and forget about it. The determined attacker will always find it. What it does do is keep the "skiddies" away. Yes, it's security through obscurity...... But this job is all about making their job that little bit harder......
Hope all that drivel helps....... ;)
thanx for the replies...
Tiger... you must've missunderstood me a bit ... i know you can run the daemon on any port of your choosing and also that there are "standard ports" for "standard services"...
i'm going to try to set up a http/mail/ftp proxy on a old slack box. i shouldn't have a problem setting up the ssh to listen for my client (on standard or non-standard port) what i need clarification w/ is
1. when the ssh makes the request on behalf of my client. how can it identify the requested service (how can ssh determince if i need mail or to browse)
2. if you guys say that the outbound port in regular straigtforward connection is "randomly" choosen...
a) does that hold true for all services (ftp, http, snmp)?
b) if so, will shh choose randomly too or will it use the same socket for all services?
c) if not, can i make choose randomy like a true browser
d) if not, can i set certain outbound ports
3. will every server understand ssh encryption?
4. will i be able to run java, shockwave, active x and everything else as in straight connection
Etruscan:
Ahhh..... Now we get to the crux of the matter..... Why didn't you ask this in the first place? Then a whole bunch of people wouldn't have been "shooting in the dark".Quote:
i'm going to try to set up a http/mail/ftp proxy on a old slack box. i shouldn't have a problem setting up the ssh to listen for my client (on standard or non-standard port) what i need clarification w/ is
1. when the ssh makes the request on behalf of my client. how can it identify the requested service (how can ssh determince if i need mail or to browse)
2. if you guys say that the outbound port in regular straigtforward connection is "randomly" choosen...
a) does that hold true for all services (ftp, http, snmp)?
b) if so, will shh choose randomly too or will it use the same socket for all services?
c) if not, can i make choose randomy like a true browser
d) if not, can i set certain outbound ports
3. will every server understand ssh encryption?
4. will i be able to run java, shockwave, active x and everything else as in straight connection
Hopefully someone can now give you a definitive answer to your questions..... 'Cos I can't.... ;)
Good luck....
How will that be any different other than adding an additional step? No matter what, the source port will be on a different high port and the connections on the destination will be on the IANA assigned (typically) port for the listening service. If your statement was correct, each connection would hit a different destination port. So then, a web server would accept one connection on 80, then another on 81 and so on? That is laughable.Quote:
I think it would be better proved to open one do netstat close it then do the other. Because if you do them at the same time it has to be a different port so that doesn't prove anything.
Here is a little something to educate yourself. Think before you post.
http://www.w3.org/Protocols/rfc2616/rfc2616.html
I meant that if you had two browsers opened connected to a site wouldn't they have to use different local ports because you can't do two things from the same port. I guess I could be wrong there because the web server serves thousands of clients from the same port with no problem. I was just under the impression that if a local port was already in use then a different one would have to be used whereas, if you connected to the site once and did netstat to see the local port being used, then closed that connection thereby freeing up that local port again, and then you opened up another connection and did netstat again only doing one at a time, that would show better that the ports are random and not the same each time, given that you would have to use a different local port if the one you wanted was already in use. Did that make sense or does anyone see my point. i could be wrong though, if so just ignore me.
Just my 2 cents
does anyone know if the ssh chooses random outbound ports as well.. pls, pretty pls
Yes it does, I just tested it and the first connection used 46767 and the second used 40775.
I'm not exactly sure what you are trying to do here. You can use ssh to tunnel other protocols but the remote server must have a sshd listening and allow port forwarding. I'm not sure what you mean using your slack box as a proxy with ssh because although you could tunnel the traffic between your client and your slack box, any traffic leaving the slack box will not be encrypted so you are only encrypting data in your internal network. If the remote server you are trying to reach has a sshd running you dont need the slack box at all and can simply tunnel the traffic to the remote machine directly. If I've misunderstood you or you would like me to elaborate let me know. :)
-Maestr0