Open Port Scan (open-port-scan)

Summary

TCP probes for unexpected open ports (excludes 80/443).

Classification

• Category: SECURITY
• Plugin id: open-port-scan
• Version: 1.0.0
• Target types: WEBSITE, API, WEBSHOP
• Weight class: LIGHT
• Risk level: HIGH
• Browser required: No (HTTP / Node / other — see source)
• Tier / group: Tier 1 — HTTP-only

Schedule

• scheduleHints: { defaultInterval: '0 */12 * * *', priority: 3 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for open-port-scan.

Check	Typical severity	Why
Database/cache port open (MySQL, Postgres, Redis, Mongo, Elasticsearch)	WARNING	Publicly reachable DB/cache ports are a top ransomware/exfil vector — TCP accept does not require auth to be dangerous.
RDP (3389) open	WARNING	Exposed Remote Desktop is brute-forced constantly; compromise gives full host control beyond the web app.
SSH, FTP, Telnet, SMTP, SMB, and similar ports open	INFO	Expected on some stacks (SSH on Linux) but worth auditing — FTP/Telnet/SMB in particular carry plaintext or lateral-movement risk.

Ports 80, 443, 8080, and 8443 are excluded from findings.

How each check works

1. Hostname — Parsed from target URL. Invalid URL → failed with no findings.
2. Port list — TCP-connects each port in config (default 15 ports: 21, 22, 23, 25, 80, 443, 445, 3306, 3389, 5432, 6379, 8080, 8443, 9200, 27017) sequentially with timeout (default 3s per port).
3. Open detection — net.connect success counts as open. Ports in EXCLUDED_PORTS (80, 443, 8080, 8443) never produce findings even if open.
4. Severity — severityForPort(): DB/cache ports (3306, 5432, 6379, 27017, 9200) and 3389 → WARNING; all other unexpected open ports (e.g. 22 SSH) → INFO.
5. Run outcome — Always warning if any finding (even INFO-only). Score 100 − 10×WARNING − 3×INFO (floor 0). Marked HIGH risk — subject to admin-only + cooldown policies at platform level.

Caveats and concerns

• TCP accept ≠ vulnerable service — Firewalls may accept then drop; filtered ports appear closed even when a service exists internally.
• Shared IP / CDN — Hostname may resolve to a shared load balancer; open ports may belong to another tenant on the same IP.
• Limited port set — Only the configured list is scanned; obscure services on custom ports are invisible.
• No banner/version probe — Does not verify MySQL vs HTTP on 8080 beyond the TCP handshake.

Source

packages/test-plugins/src/plugins/open-port-scan.ts