If you check on his site, you will notice that the port is user-specifiable, so it could run on ANY port. However, it defaults to port 8080 (a port well known for running httpd on a box not owned as root), so it shouldn't be that hard to track as default. Anyone wanting to cover their tracks would naturally not use 8080. The best defense is to know exactly which ports should be open and look for anomalies rather than have a red light come on when a particular port is scanned as open.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/70/2949#2949