What can an attacker reach on your network?
An attack surface is every place where an attacker can try to get into a system. On a network, it is the open ports and the programs that answer on them.
If you can list your attack surface, you know what to defend and what to switch off.
A small firm once left a remote login running on a file server nobody used. It was never visited, yet it was a door.
By the end of this lesson
Note
I can list what a network exposes.
Key words
| Word | What it means | Example |
|---|---|---|
| Attack surface | every place an attacker can try to get in | |
| Port | a number that tells a machine which program a connection is for | 443 |
| Service | a program that waits for connections on a port | |
| Open port | a port where a service answers | |
| Port scan | trying many ports to see which ones answer | |
| Filtered | a port where a firewall gives no answer at all |
The cells students fill in are left blank in this preview.
A service listens on a port
A machine runs many programs at once. A port is a number that says which one a connection is for. Port 443 is a secure web page, and port 22 is remote login.
A service waits on its port. We say it is listening.
Every listening service is a place an attacker can knock. A service with a flaw, an old version or a weak password is a way in.
Worked example: common ports and what they carry
| Port | Service | What it is for | Usually exposed? |
|---|---|---|---|
| 22 | SSH | Remote login for administrators | Only to the people who need it |
| 80 | HTTP | Web pages with no protection | Yes, if it only redirects |
| 443 | HTTPS | Web pages with protection | Yes, for a public site |
| 3306 | MySQL | A database | No, keep it inside |
| 3389 | RDP | Remote desktop for Windows | No, put it behind a tunnel |
The cells students fill in are left blank in this preview.
Meet the three machines
netlab statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
List what the LAN host is listening on
sudo ip netns exec lan ss -ltnShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
List what the gateway is listening on
sudo ip netns exec gw ss -ltnShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
What the two lists say
The command ss -ltn lists listening TCP ports as numbers. Each machine in the lab has its own list.
The LAN host lists port 80, its web page, and port 8081, a private page. That is its attack surface: two ports.
The gateway prints only the heading. It listens on nothing, so no service on it can be attacked.
A port scan asks every port in turn
A port scan tries to connect to many ports and records what happens. A defender scans to see the surface the way an attacker would.
There are three answers. Open: a service replied. Closed: the machine answered, but nothing listens. Filtered: nothing came back, usually because a firewall dropped the request.
The one rule
Warning
Scan only this lab. Its machines are yours alone and reach nobody else. Scanning a network that is not yours, without written permission, can be a crime under the Computer Misuse Act 1990.
Scan the LAN host from the gateway
sudo ip netns exec gw python3 -c "import socket; print([p for p in (22, 80, 443, 8081) if socket.socket().connect_ex(('10.0.0.2', p)) == 0])"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Scan the gateway from the outside server
sudo ip netns exec srv python3 -c "import socket; print([p for p in (22, 80, 443, 8080) if socket.socket().connect_ex(('203.0.113.1', p)) == 0])"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Reading the two scans
The one line tries four ports and prints the ones that connected. From the gateway it prints [80, 8081]: the same two ports ss showed.
From the outside server it prints []. No port on the gateway answers, so the outside sees no surface there.
The outside server cannot reach the LAN host at all, because it has no route to the private range.
Worked example: reading a scan report
| Line | State | What it tells you | What to do |
|---|---|---|---|
| 22 ssh | open | Remote login is reachable | Allow it only from the admin network |
| 23 telnet | open | Remote login with no protection | Switch it off |
| 445 smb | filtered | A firewall is hiding a file share | Check the rule is meant |
| 3306 mysql | closed | Nothing is listening | Nothing, this is good |
The cells students fill in are left blank in this preview.
A common mistake
Warning
Many people think a quiet network has no attack surface. The surface is what is listening, not what is used. A forgotten service that nobody visits is still a door. List it, then close it or protect it.
Going further: shrink a surface
Start your own list for the LAN host. For each listening port, write what the service is for, who needs it, and whether it should be reachable from the outside.
The private page on port 8081 is meant for the LAN only. Which of your three choices would you make for it, and why?