3

I have a number of servers, all with various HTTP(S) services accessible on a variety of ports. It's incredibly difficult to keep track of which service is available under which host and what port. Often I'm just relying on my browser history.

Is there some shell command (some variation of netcat) or script that can, from a given server, list every port that is serving a web page? Or every port using HTTP or HTTPS?

4

One specific script, no, but there is a way to get that information. Several ways, probably. I would start with netstat -tuln, which will tell you what ports have listening services associated with them. You can then look at things like fuser -n tcp <port num> to tell what PID(s) is/are listening to a given port, which can then tell you what daemon / process is associated with that PID.

In all seriousness, though, you're better off figuring this out once, and then being a complete bastard about making sure documentation of it stays current, whether that means beating yourself over the head or beating someone else over the head - repeatedly - with a clue-by-four.

  • 2
    At least with GNU netstat you can use the -p to get it to show you the PID/process name that is using the port – Eric Renouf May 13 '15 at 16:47
  • One could also try nmapping the server with the service detection option enabled (-sV) and then inspecting / parsing the output for http. I don't know how robust or accurate nmap's service detection algorithms are but nmap itself is well-regarded. – jw013 May 13 '15 at 16:51
  • @jw013 - NMap tends to label ports as what the host it's running on thinks they should be, not necessarily what actually is running on them. So if you have an HTTP(s) service running on port 23, it'll most likely get labeled as "telnet". Aside from that, yeah, nmap is an excellent way to start. – John May 13 '15 at 16:53
  • 1
    @John I am aware of nmap's default behavior which is why I commented about the -sV option that causes nmap to switch from its default database of "well known" port numbers to a more intrusive identification algorithm, where it will actually send GET requests to the port in question. I just tested it on my machine and it was able to successfully identify a http service on port 23. Without -sV it went back to labelling it as telnet. – jw013 May 13 '15 at 16:58
  • So, how do you plan to infer from a PID which server instance said PID corresponds to, and which other (virtual) hosts and ports it serves? – lcd047 May 13 '15 at 17:04
0

You could do that with a nmap and a script, e.g. http-get.nse*

$ nmap -p* --open --script http-get.nse --script-args http-get.path=/,http-get.match="downloads" 192.168.13.2

Starting Nmap 6.40 ( http://nmap.org ) at 2015-05-13 23:09 CEST
Nmap scan report for 192.168.13.2
Host is up (0.029s latency).
Not shown: 4235 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
53/tcp   open  domain
80/tcp   open  http
| http-get: 
|_  GET / -> 200 OK
5050/tcp open  mmcc
| http-get: 
|_  GET / -> 200 OK
5051/tcp open  ida-agent
| http-get: 
|_  GET / -> 303
5055/tcp open  unot
| http-get: 
|   GET / -> 200 OK
|_  Matches: downloads
8118/tcp open  privoxy
| http-get: 
|_  GET / -> 400
8200/tcp open  trivnet1
| http-get: 
|_  GET / -> 200 OK

Nmap done: 1 IP address (1 host up) scanned in 17.31 seconds 192.168.1.1

It issues a http request to every open port found and asks for the page at path given in http-get.path= in --script-args and looks into the response to find a matching keyword defined in http-get.match=

If an open port is found, it reports the status code of the GET request and possibly a match of keyword.

5055/tcp open  unot
| http-get: 
|   GET / -> 200 OK
|_  Matches: downloads

This script might need further tweaks, eg. I haven't tested support for https. But it should get you started.

* I forked to fix and tweak it. Credit for the script goes to David Wittman.

0

Assuming you can login to the host and see running processes, the simplest way is to use netstat

netstat -lnp | grep <apache|httpd>

Use apache for debian, httpd for cent/rhel. Barring that option, you can use nmap to discover the services provided you don't have an IDS/IPS that will shut down your connections at a given point.

Or use browser bookmarks or shell aliases.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.