nerdexam
GIAC

GSEC · Question #87

Why would someone use port 80 for deployment of unauthorized services?

The correct answer is D. HTTP traffic is usually allowed outbound to port 80 through the firewall in most environments. Port 80 (HTTP) is a standard, well-known port that most firewalls permit for outbound web traffic. Attackers exploit this by tunneling unauthorized services through it to evade detection.

Network Security

Question

Why would someone use port 80 for deployment of unauthorized services?

Options

  • AGoogle will detect the service listing on port 80 and post a link, so that people all over the world will
  • BIf someone were to randomly browse to the rogue port 80 service they could be compromised.
  • CThis is a technique commonly used to perform a denial of service on the local web server.
  • DHTTP traffic is usually allowed outbound to port 80 through the firewall in most environments.

How the community answered

(44 responses)
  • A
    11% (5)
  • B
    2% (1)
  • C
    5% (2)
  • D
    82% (36)

Why each option

Port 80 (HTTP) is a standard, well-known port that most firewalls permit for outbound web traffic. Attackers exploit this by tunneling unauthorized services through it to evade detection.

AGoogle will detect the service listing on port 80 and post a link, so that people all over the world will

Search engine indexing is unrelated to the security rationale for choosing port 80 and would actually increase the visibility of an unauthorized service rather than conceal it.

BIf someone were to randomly browse to the rogue port 80 service they could be compromised.

While accidental browsing to a rogue service is a possible consequence, it is not the primary technical reason attackers choose port 80 - firewall evasion is the core motivation.

CThis is a technique commonly used to perform a denial of service on the local web server.

Running a service on port 80 does not inherently cause a denial of service condition on the local web server; that would require intentional resource exhaustion.

DHTTP traffic is usually allowed outbound to port 80 through the firewall in most environments.Correct

Most network firewalls are configured to allow outbound TCP traffic on port 80 to enable normal web browsing. By hosting an unauthorized or rogue service on port 80, an attacker's traffic blends with legitimate HTTP traffic, making it much more likely to pass through perimeter controls without triggering alerts or blocks.

Concept tested: Firewall evasion using permitted port 80 HTTP traffic

Source: https://attack.mitre.org/techniques/T1571/

Topics

#port 80#firewall evasion#covert channels#unauthorized services

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSEC Practice