Port Scanner

What Is a Port Scanner?

A port scanner probes a target host to determine which TCP or UDP ports are open and accepting connections. Every service running on a server — a web server, an SSH daemon, a database — listens on a specific port. By scanning the ports, you build a picture of what's running on the server and how exposed it is to the internet.

Port scanning is a fundamental step in any security assessment. Attackers use it to map out attack surfaces. Defenders use it to verify their firewall rules are working and to identify services that shouldn't be publicly reachable.

How This Scanner Works

This tool performs a TCP connect scan. For each port in our scan list, we attempt to open a TCP connection using non-blocking sockets. If the connection succeeds within the timeout, the port is open. If it's refused, the port is closed. If there's no response, the port is filtered (usually by a firewall).

Unlike aggressive port scanners (like nmap with SYN scanning), our approach:

• Requires no root privileges on the scanning server
• Is indistinguishable from a legitimate visitor connecting to your services
• Does not attempt service fingerprinting or banner grabbing beyond basic protocol detection
• Uses parallel non-blocking sockets — 30 ports scanned in ~2 seconds

Ports We Scan and Why

Web Ports (80, 443, 8000, 8080, 8443, 8888)

Standard HTTP and HTTPS. Non-standard ports (8000, 8080, 8443, 8888) often host development servers, admin panels, or API endpoints that should not be publicly exposed.

Mail Ports (25, 110, 143, 465, 587, 993, 995)

SMTP for sending, POP3 and IMAP for receiving. Normal if you run a mail server. Should use TLS versions (465/587 for SMTP, 993/995 for IMAP/POP3) and never expose plaintext versions to untrusted networks.

Remote Access (22, 23, 3389, 5900)

SSH, Telnet, RDP, and VNC. SSH on port 22 is common and reasonable. Telnet (23) sends credentials in plaintext and should never be used. RDP and VNC should be behind a VPN, never exposed to the public internet.

Databases (1433, 3306, 5432, 6379, 11211, 27017, 9200)

MSSQL, MySQL, PostgreSQL, Redis, Memcached, MongoDB, Elasticsearch. None of these should ever be publicly accessible. They have no business being reachable from outside your private network. Exposure of any of these is a critical finding.

File Transfer (21, 139, 445)

FTP, NetBIOS, and SMB. FTP transmits credentials in plaintext. SMB and NetBIOS on the public internet are a major risk — they've been used in ransomware attacks (WannaCry, NotPetya) and should always be firewalled.

Other (53, 2375, 15672)

DNS on TCP, Docker API, and RabbitMQ Management. Docker API exposed publicly allows full container takeover. RabbitMQ Mgmt exposed publicly allows message queue manipulation. Both are critical.

Why Exposed Database Ports Are Critical

Every few months there's a story about a company leaking millions of records because a MongoDB, Elasticsearch, or Redis instance was left open to the internet. This happens constantly — automated bots scan for these ports continuously and exploit them within minutes of exposure.

Modern databases like Redis, Memcached, and MongoDB often ship with authentication disabled by default. If you spin one up on a cloud server and don't have a firewall in front, it's public within minutes and compromised within hours.

If this scanner reports any database port as open, treat it as an emergency. Restrict it immediately.

Understanding Your Scan Results

Each open port gets a risk classification:

• Critical — Redis, Memcached, MongoDB, Elasticsearch, Docker API, RabbitMQ Mgmt. Authentication often disabled by default.
• High — Traditional databases (MySQL, PostgreSQL, MSSQL), RDP, VNC, Telnet, SMB. Requires auth but should never be public.
• Medium — FTP, POP3, IMAP, alternative web ports. Legacy protocols or admin interfaces.
• Info — Standard web ports, mail with TLS, SSH. Normal for a public server.

Ethical & Legal Considerations

Port scanning is a gray area legally. In most jurisdictions it's not explicitly illegal, but unauthorized scanning of systems you don't own can:

• Violate computer misuse laws in some countries (US CFAA, UK CMA, India IT Act)
• Trigger intrusion detection systems and get your IP banned
• Be interpreted as a precursor to attack

Only scan hosts you own or have explicit written permission to scan. If you're evaluating a potential client or vendor, ask first. The consent checkbox exists for a reason.