Port Egress Testing

One of the common tasks conducted during an internal penetration test is to determine how data can be exfiltrated off the network. When configuring outbound firewall rules the general guidance is that only the necessary traffic is permitted outbound to the internet. It allows for greater control over how internal devices can interact with devices on the internet. This may help in preventing compromised devices communicating with C2 servers, or having sensitive data being exfiltrated.

The Problem

Many public webservers exist which have all TCP and UDP ports open, which you can then scan to identify open outbound ports. letmeoutofyour.net and portquiz.net (TCP only) are two of the main ones. The issue i found was when scanning these servers, due to various factors the results from the scanner wernt allways completly accurate. Intermediary devices like proxy servers sometimes responed to request which indicated the open port, or traffic would reach the destination but the port reported as being closed. I needed a way of identifying what traffic actually reached the server.

The Solution

I created a tool which does just that. portleak.link displays all traffic that reaches the server ,giving you a for-sure method of identifying the permitted outbound traffic.

The server does not respond to any UDP packets or TCP SYN’s, so the scanner used to scan the webserver will show all ports as closed. It will however show all traffic that has hit the webserver, and so the web interface provides undeniable proof that outbound traffic is permitted, if it appears in the server logs.

To use the tool, enter the public IP in the filter at the top, and then start the scan. All the results will show in the table. They can then be exported into a CSV or XLSX as needed. A Scan Scripts Page is also on the website. This provides a selection of ways the website can be scanned, from both Windows and Linux devices.

I hope the tool is useful for people. Please consider Donating if you use it regularly, to help with the running costs. It would be much appreciated. It would be great to hear of your experiences with it as well. contact details can be found on the bottom left of the page.