0xoscp-companion
← Back to search

Port Knocking to Open a Filtered Port

enumerationtool

Summary

Send a sequence of connection attempts to the secret knock ports to unlock a firewalled service (e.g. SSH), then connect normally.

Walkthrough

A knock daemon hides a service until it receives connections to a specific ordered sequence of ports.

Steps

  1. Hit each knock port in order with quick Nmap probes (the --host-timeout/--max-retries 0 flags keep them fast and fire-and-forget).
  2. Once the sequence completes, the firewall opens the protected port — connect normally (e.g. SSH in with the recovered key).

Commands

bash

for i in 571 290 911; do
  nmap -Pn --host-timeout 100 --max-retries 0 -p $i <IP> >/dev/null
done

bash

ssh -i ~/keys/id_rsa_nineveh_amrois amrois@<IP>