Common attacks and weaknesses
- Flask debug mode (Werkzeug console) allows remote code execution.
- Unauthenticated private registries leaking images and secrets.
Port 5000: Flask / Docker registry / UPnP
Default for Flask development servers and Docker registries; macOS uses it for AirPlay Receiver.
5000
How Flask / Docker registry / UPnP works
WebA browser sends an HTTP request to port 5000 and the Flask / Docker registry / UPnP server sends the page back. It travels in clear text: anyone on the path can read it, passwords included.
- Transport
- TCP · UDP
- Exposure risk
- 5/10 moderate if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assignedcommon use differs from the registry
- Range
- Registered (1024-49151)
- Category
- Web
Is port 5000 dangerous?
How to secure it
- Never run debug mode on reachable interfaces.
- Protect registries with authentication and TLS.
Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.
IANA registry entries for port 5000
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| commplex-main | 5000 | TCP, UDP | - | - |
// source: IANA service name and port number registry
Which program uses port 5000, and is it reachable?
Linux
sudo ss -ltnup 'sport = :5000' # process listening on 5000
sudo lsof -nP -i :5000macOS
sudo lsof -nP -i :5000
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 5000 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 5000 netstat -ano | findstr :5000
From another machine
nmap -p 5000 -sV <host> sudo nmap -sU -p 5000 <host> nc -zv <host> 5000
Block it in the firewall
sudo ufw deny 5000/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 5000" -Direction Inbound -LocalPort 5000 -Protocol TCP -Action Block # Windows
What is port 5000 used for?
Default for Flask development servers and Docker registries; macOS uses it for AirPlay Receiver.
Is port 5000 TCP or UDP?
Port 5000 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 5000?
It is rated 5/10 (moderate) when exposed to the Internet. Flask debug mode (Werkzeug console) allows remote code execution. Never run debug mode on reachable interfaces.
How do I check if port 5000 is open?
On Linux run "ss -ltnup 'sport = :5000'", on macOS "lsof -nP -i :5000", and on Windows "netstat -ano | findstr :5000" to see the local process. From another machine, "nmap -p 5000 <host>" shows whether it is reachable.
Other web ports
:443 HTTPS tcp · udp · sctp · low risk :80 HTTP tcp · udp · sctp · moderate risk :8080 HTTP alternate tcp · udp · high risk :8443 HTTPS alternate tcp · udp · moderate risk :3000 Dev servers / Grafana tcp · udp · moderate risk :8000 HTTP alternate (dev) tcp · udp · moderate risk :8888 Jupyter / HTTP alternate tcp · udp · high risk :9443 HTTPS alternate (admin) tcp · udp · moderate risk