Common attacks and weaknesses
- Open proxies used to anonymize attacks.
- Pivoting tool left by attackers (SOCKS tunnels over compromised hosts).
Port 1080: SOCKS proxy
SOCKS proxy.
1080
How SOCKS proxy works
VPN, tunnels & proxiesTraffic is wrapped in a tunnel between the two ends, so the network in between only sees the tunnel. It travels in clear text: anyone on the path can read it.
- Transport
- TCP · UDP
- Exposure risk
- 7/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- VPN, tunnels & proxies
Is port 1080 dangerous?
How to secure it
- Require authentication and restrict clients.
- Investigate unexpected SOCKS listeners.
IANA registry entries for port 1080
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| socks | 1080 | TCP, UDP | Socks | - | - |
// source: IANA service name and port number registry
Which program uses port 1080, and is it reachable?
Linux
sudo ss -ltnup 'sport = :1080' # process listening on 1080
sudo lsof -nP -i :1080macOS
sudo lsof -nP -i :1080
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 1080 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 1080 netstat -ano | findstr :1080
From another machine
nmap -p 1080 -sV <host> sudo nmap -sU -p 1080 <host> nc -zv <host> 1080
Block it in the firewall
sudo ufw deny 1080/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 1080" -Direction Inbound -LocalPort 1080 -Protocol TCP -Action Block # Windows
What is port 1080 used for?
SOCKS proxy.
Is port 1080 TCP or UDP?
Port 1080 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 1080?
It is rated 7/10 (high) when exposed to the Internet. Open proxies used to anonymize attacks. Require authentication and restrict clients.
How do I check if port 1080 is open?
On Linux run "ss -ltnup 'sport = :1080'", on macOS "lsof -nP -i :1080", and on Windows "netstat -ano | findstr :1080" to see the local process. From another machine, "nmap -p 1080 <host>" shows whether it is reachable.