312-50V13 · Question #106
Null sessions are un-authenticated connections (not using a username or password.) to an NT or 2000 system. Which TCP and UDP ports must you filter to check null sessions on your network?
The correct answer is D. 139 and 445. To identify potential null session vulnerabilities on a network, an administrator must filter TCP and UDP traffic on specific ports associated with NetBIOS and SMB services.
Question
Options
- A137 and 139
- B137 and 443
- C139 and 443
- D139 and 445
How the community answered
(23 responses)- A4% (1)
- D96% (22)
Why each option
To identify potential null session vulnerabilities on a network, an administrator must filter TCP and UDP traffic on specific ports associated with NetBIOS and SMB services.
While UDP port 137 is used for NetBIOS Name Service, null sessions primarily exploit the session-based communication on TCP ports 139 and 445, not just name resolution.
UDP port 137 is for NetBIOS Name Service, but TCP port 443 is used for HTTPS (secure web traffic) and is unrelated to NetBIOS or SMB null sessions.
TCP port 139 is relevant, but TCP port 443 is for HTTPS and does not facilitate null sessions via SMB.
Null sessions exploit vulnerabilities in the Server Message Block (SMB) protocol, which traditionally operates over NetBIOS. TCP port 139 is used for the NetBIOS Session Service, enabling connection-oriented communication. TCP port 445 is used for SMB over TCP/IP directly, without relying on NetBIOS, and both ports are common targets for null session attacks.
Concept tested: Null session vulnerabilities and associated ports
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements
Topics
Community Discussion
No community discussion yet for this question.