[ale] Ports for known hacks

[Jonathan Rickman]

On Mon, 25 Sep 2000, JEM wrote:

> I was searching for a list of ports used by known
> hacks that I could compare to some of the ports
> that I have seen connection attempts against.  I
> haven't been able to find anything except the 
> standard services list.  Anyone know where a list
> of ports used by known trojans/hacks might be?
> Someone using an AOL IP address attempted to connect
> to port 1142 on my box and I can't find a reference
> to that anywhere.
> 
> JEM
> --
> To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" in message body.
> 

That's a tough one to chase...probably not worth your time. Most known
trojans can be configured to listen on any port. Even the most
inexperienced kiddies have figured this out by now. As far as a
reference...a google search should turn up several lists. Personally I use
the port search applet at http://www.ndrs.com

hope this helps...

-- 
Jonathan Rickman
X Corps Security
http://www.xcorps.net


-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGP 6.5.2

mQENAzm0QZQAAAEIAN3uNRQlWHMrHwKgTNzpYps6SLipfNvH+0uZi0TvxyXFHiiH
kivQYxlcPn/4Za4eyl5XZvP6lGQ3DXcCzT+9di75HqFtTiHeE9YScR0WEeBB1ywL
j8nKxFdGMCJ3a3khSafPvyTUQKGaEWQGnui+6UieWeBhDHdE/o21qNd0+6M49P73
0pVTdmdn1jPj1cU+vrqkNWMfNNNhLyPjrdPzoL6SoYzCs6p5YhLWaNOiet/91RhK
VpC8uy2cUIWNOAyAOtDJwF4GY+AIVP2WTLg6L/FByDH507HP4NvkbnwPAkDSTh7M
TlXvdoeNiaEUCYCgx8CFSCAg/pl819+gts810D8ABRG0JkpvbmF0aGFuIFJpY2tt
YW4gPGpvbmF0aGFuQHhjb3Jwcy5uZXQ+iQEVAwUQObRBlNffoLbPNdA/AQETwwf/
d4W131UXeWd1+hcCR1bkFJRx+08fNtHzbMzjqquA4IRPftt72M6RzDsRn1xpsdh+
RqP0oeZ0IfnByhXQ7x65JxRUaYW2mw8GNQOeTkJ2uNDg3SaFG2HGYxASohP2r8D6
Yh1WIfEgf3YDwoKyGAfJTgcfHZe85+hgg6R60KbGMAhWf5Tbb6IEpzdvBi/HoYHC
c1km8esjnMPDmR1aLjcRffaMmWGwXk/33oZRo3Q0SO/MvqWyo1kZnq2JIxX0MDAm
nm2p0cZtQc1sECkC1XyyyH8tgWhXwzYpucpsQ3IhWFrCuL7y4t/wREOgd4KaSxkN
OKraa8g7Nyh4s8rSHFvq5A==
=XYFV
-----END PGP PUBLIC KEY BLOCK-----

--
To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" in message body.