1

I scanned my local network and found that Kali linux was exposing apache2 on port 3000. Its a pretty much vanilla installing running inside Virtualbox on an OSX host

Is this there by default and why does it show powered by CentOS on the test page?

Linux kali 4.0.0-kali1-amd64 #1 SMP Debian 4.0.4-1+kali2 (2015-06-03) x86_64 GNU/Linux

I tried stopping the httpd and apache(2) services but its still running. Very weird!

UPDATE : Further confusion

After a reboot apache was no longer listening on port 3000. Starting it made it available on port 80 and with debian information on the default home page and not centos

2

I traced this to BeEF which starts its own webserver on port 3000. I dont know anything about BeEF but it looks to be a ruby application pretending to be a web server.

0

It listens on that port by default. As for the CentOS statement: It would really depend on the code within the default page that's being loaded up - or whether it's just static and is a web-page copied from another distribution (CentOS).

As it's meant to be a hardened OS used for penetration testing, I'd take a guess at that being the reason why it avoids listening on the default port. I'm unable to confirm this and couldn't find anything giving official reasoning as to why on the documentation around the net however.

  • Thanks. For the very reason that Kali is intended for that purpose, I am nervous that a non standard port was open without me knowing about it. – codecowboy Oct 2 '15 at 6:32
  • Port 3000 doesn't look like a randomly generated, and listening on a fixed custom port is just as bad security-wise as listening on the default one, only more confusing for legit users. – Dmitry Grigoryev Oct 2 '15 at 7:18
  • It's not randomly generated and I don't think I stated that. As for the security-wise comment, of course that anyone scanning can find that the port is open. It's not any more secure, but it is slightly more obscure as it's hardly as common as port 80 - so attacks that specifically target port 80 wont get anywhere on port 3000. Whether it's confusing or not, a web-server on Kali Linux I doubt is very much for general purposes - and if it is, the port should be changed to 80 unless you've got an specific set of users who are aware of the port being used. – Hugh Oct 2 '15 at 10:36
  • Without knowing the true reasoning behind port 3000 being used however, it's hard to justify its use. – Hugh Oct 2 '15 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.