~/tutorials/027-a-service-on-the-wrong-port.md

027: A service answering on the wrong port

Port 22 is ssh the way the first house on a street is the Smiths: a convention, not a law. This lesson is about the day the convention breaks, because a service on the wrong port is either an operator hiding it or an intruder hiding in it, and both look identical from outside.

The convention, and what it is worth

nmap 127.0.0.1

22/tcp  open  ssh
80/tcp  open  http
443/tcp open  ssl/http

Three rows, three conventions, and the SERVICE column here is the scanner's guess from the port number alone: nothing has talked yet. The guess is usually right because administrators keep defaults, and it is exactly that usually that a wrong-port service exploits. Nobody double-checks the obvious.

Why services move

Legitimately, constantly: ssh to 2222 to dodge drive-by scanning, a database to a high port because the firewall allows it, an internal admin panel on 8080 because 80 was taken. Every one of these teaches the network that the port number means less than the protocol, and the lesson lands wrong the day it matters.

Defensively, rarely, and this is the shape that matters: an intruder's service on an unexpected port, chosen precisely because your eye slides past it. The classic is port 443 on a machine that has no business terminating TLS, or ssh on a port your own scanner was told to skip. It does not need to be clever. It needs to be boring, and port numbers are where boring lives.

The check that catches it

The SERVICE column is a guess. The VERSION column is a conversation:

nmap -sV 127.0.0.1

When the port and the banner disagree, believe the banner. An https port answering with an ssh banner is not a mislabelled web server, and the mismatch is the finding. This is lesson twelve's rule, upgraded: not just "the column that asked is the column to believe", but "when the columns disagree, the disagreement is the finding". A wrong-port service is definitionally a disagreement between what the number promised and what the door said.

The port you did not scan

The quietest wrong-port service is the one outside your range. Lesson sixteen's snapshot shows three open of a thousand probed, and the accounting line is what makes that a full scan. The moment you scan a port list instead of the range, you have delegated your exposure map to whatever wrote the list, and services on unlisted ports do not hide from full scans, they hide from shortcuts. nmap -p- on your own host at home is the honest full range, and the boring high port it turns up is this lesson arriving in person.

Try it

Each of these has one answer, and the shell gives it to you. Check yourself.

1. Run both scans and read the SERVICE column against the VERSION column, row by row. Any disagreement on this host today, and what would one mean if it appeared?
2. On your own machine, run the full range scan and read every row that is not a convention you set yourself. Anything you cannot explain in one sentence is the deliverable.
3. Say why an intruder picks a boring port rather than a weird one. The answer is in the first paragraph, and it is worth saying out loud once.
4. Write the four-field finding for a hypothetical wrong-port service: ssh answering on 443, banner honest, convention broken. What it does not prove is the part that matters.

Snapshot banners age with the host. The disagreement, when it appears, is the current truth.