What are the actual security implications of port forwarding? reddit / selfhosted ---------------------------------------------------------------------- Alt_Lightning · 2023-11-12 22:39 Like, I hear all the time that you shouldn't open any ports on your networks fire wall for security reasons this and security reasons that. But what are the actual security implications/risks of forwarding a port for something like Jellyfin or a Minecraft server or something like that? Explain like im 16 (or something) ---------------------------------------------------------------------- LavaCreeperBOSSB · 2023-11-12 22:48 If you port forward for example, ssh (port 22), then a port scanner would know you have SSH and could try to find your password or shut it down. ---------------------------------------------------------------------- emprahsFury · 2023-11-12 22:50 The actual implication is that there's an unmediated mechanism of access into your network. Simple as. If you're confident that someone looking in will only see the front- end of something you trust, that's cool you're good. Oftentimes though people don't know what they don't know, and we only find out that we don't know after we've moved from the prevention phase to the remediation phase. ---------------------------------------------------------------------- Alt_Lightning · 2023-11-12 22:50 I see. In a more realistic example for me, it would be a service related port (such as 8096 by default for Jellyfin), and the service would have an actually decent username and password. How does this differ from your example? ---------------------------------------------------------------------- qriff · 2023-11-12 22:57 The confusion is about concepts, terminology and language barriers. The definition is you should never "expose" services publicly online (for unlimited attempts of intrusion) as they all contain x amount of known or unknown vulnerabilities at any given time. It does matter which way the exposure is accomplished. Firewalls or port forwarding (NAT) has nothing to do with it, but is often related discussion being the method of exposure. ---------------------------------------------------------------------- LavaCreeperBOSSB · 2023-11-12 23:04 You could still bruteforce Jellyfin's password, just over a longer period. A much better solution would be to setup a reverse proxy, like Nginx, and use a domain (duckdns if you want a free one) and Cloudflare DNS for proxying to use HTTPS ---------------------------------------------------------------------- tomistruth · 2023-11-12 23:44 A port is a memory address. Think of it like a mailbox but that can receive continuous data packages and automatically response back. If an attacker knows your IP and Port, he can send malicious data and try to gain access to the computer, be it your own pc, or a gaming server. Port forwarding is a rule that allows your application to negotiate with a firewall, be it from your own computer, server or router to pass data with the outside world. At home, when you have a PC you usually are connected to the router. So the usual way would be to go to the router to enable port forwarding on a specific port. So when you launch your minecraft server, it will negotiate with the firewall of your router, it then sees your entry and says "Alright, you can go outside, but I will close the port, when you are not using it." When you open a port on the router directly, the port stays open 24/7. This would be like port 22 for ssh. Although port 22 is open for ssh, the ssh application itself is secure enough, that not just anybody can forceful enter it. There is also a difference between Windows port forwarding and Linux port forwarding and which firewall application actually does the port forwarding. Windows and Linux are quite different and Windows implements port forwarding differently than Linux and it has different meanings. Just remember there are temporarily open ports, and permanently open ports. Temporarily open ports like games or your application you use, are only vulnerable when you run them. Permanently open ports, like a 24/7 Minecraft server are much more prone to port scanning bots and subject to brute attacks from bots. Those applications should be protected with some safeguard mechanism like fail2ban on linux to block after too frequent login attempts. But those are more advanced topics, that you have to get into slowly. As you can see, security depends on a lot of things like the application, the operation system and the hardware. For your minecraft server, I'd say it's safe enough it enable port forwarding, (how else would your friend connect to it otherwise anyways), just make sure to keep your minecraft server up to date. You can also consider creating a virtual private network, but that topic is a little more advanced. ---------------------------------------------------------------------- Mephidia · 2023-11-12 23:56 You’re allowing random people to access those services. Jellyfin almost definitely has a 0 day exploit so anyone who has access would potentially be able to use that on you. I would wager burning a 0 day on a random is probably not gonna be happening but also the odds of a random realizing they’ve been hacked is pretty low too so you never really know. ---------------------------------------------------------------------- Bulky_Construction51 · 2023-11-13 00:10 Also be aware that an exposed port that has an application responding to requests can give information that might reveal weaknesses (for example old versions with available exploits). I know Minecraft was very exploitable earlier, I guess with that specific version an attacker would still be able to get access to your machine in some cases. So port forwarding is like unlocking a door. As long as the stuff inside the door knows how to handle unwanted guests then no problem. But the challenge, as others have mentioned, is to make sure you actually know everything is secure. ---------------------------------------------------------------------- paloalt · 2023-11-13 00:40 You've got to ask yourself the question, how confident are you in the resilience of the service being exposed. It's no help to you to have a great password if there's a bug in the code of the exposed app that allows it to be bypassed. In the case of Jellyfin I'd suggest that it's probably more focused on being a decent media server than having bulletproof security. Even a config error could create a vulnerability in an otherwise secure setup. Without wanting to encourage "security through obscurity", you should also consider how well-known a service is and how much effort there is by bad actors against a service. OpenSSH is a well regarded bit of software, but if you open port 22 to WAN then you will literally see hundreds of port scans and login attempts per hour against any random IP. As a result very few people will expose port 22 or OpenSSH, even though it's very well regarded in terms of security. The usual middle-ground advice on accessing your services from WAN is to set up a reverse proxy with good quality authentication, per u/LavaCreeperBOSSB. That way you have a single entry point (usually port 443) which gives away very little about what services are on the other side of it, HTTPS encryption that should be trustworthy via nginx or Apache, and an authentication service that is specialised in secure authentication (like Authelia or Authentik). Even that is regarded by some as an unacceptable risk profile, and they'll lock everything down from the WAN side except for a VPN. If you are looking at the above and saying something like 'that all sounds WAY too hard to configure and I don't know what half of those things are,' then my advice is that you are not in a place where you should consider exposing services directly - you are guaranteed to make a benign-seeming config error somewhere, or take some shortcut, that leads to your security being compromised. If on the other hand you think it sounds interesting, there are HEAPS of guides out there for setting up a reverse proxy - SWAG is popular, I use nginx-proxy-manager - and it is a super fun project! ---------------------------------------------------------------------- PowerfulAttorney3780 · 2023-11-13 01:13 Excellent summary. It's not what's going to happen, it's what could happen. ..and what you're prepared for, or not... ---------------------------------------------------------------------- PowerfulAttorney3780 · 2023-11-13 01:23 This is why people should have that Malwarebytes program that INTEGRATES with Windows Defender and it pops things up whenever something tries to leave your network. My rule is if it's something I know, and signed, I'll allow it which creates a rule for it to go again, but usually I deny that bitch until I find out it was an important updater but for some reason ran a sketchy looking random letters and numbers name from a tmp directory 🤣🤣🤣 but you can also stop shit like programs trying to phone home with data it collected about you. Like on my HP Laptop, anything that says it's from HP gets auto blocked. "Hah hah bitch, you're on my device but you're never getting out!!! Bwahaha" ---------------------------------------------------------------------- drizzleV · 2023-11-13 01:36 Forwarding a port is like poking a hole on your wall so that people outside can see into your house.If you are sure that the object behind the hole is exactly what you want to see from outside and no one else can see what you don't want them to see, you're good to go. ---------------------------------------------------------------------- bucksnort2 · 2023-11-13 02:07 It wasn’t just Minecraft, it was the version of Java it was running on. Log4J had a huge vulnerability that was discovered in Minecraft, but anyone running that version of Java using Log4J was vulnerable. That has been patched and if an application depends on the older version, there are flags that they can run when launching the program to prevent the exploit. That’s why it was such a huge deal. ---------------------------------------------------------------------- bucksnort2 · 2023-11-13 02:15 Opening ports itself isn’t the issue, it’s what’s running behind those ports. If I’m running the ftp package VSFTPD 2.3.4, it doesn’t matter what port it’s open to, I can easily get a root shell to your device and use that as a pivot point for the rest of your network. However, if you have a Minecraft server, it’s generally safe to open a port to that. It’s good practice to whitelist users that are allowed to play on your server, otherwise anyone could hop on. It’s best to keep ports closed until they need to be open, and close them as soon as you don’t need them anymore. I have a couple of ports open on my router for some things I self host, but I have other things in place to hopefully alert me if something happens, like an Intrusion Detection System (IDS) and fail2ban to catch people trying to brute force usernames and passwords. ---------------------------------------------------------------------- cubernetes · 2023-11-13 02:56 Port forwarding itself has 0 security implications on its own, except when the router itself is vulnerable. Imagine a secure router that forwards port 22 to port 8022 on 192.168.0.20. This is completely safe if there is no device with the IP 192.168.0.20, or if the device with IP 192.168.0.20 has port 8022 closed. The attacker can do whatever they want and "send malicious packets" to your routers port 22, but if there's nothing on the other side, there's no problem. It all depends on the service that you configure on the other side, but port forwarding itself is not the problem. You're not poking a hole into your network, it's not like an attacker could enumerate your local devices. It really really only becomes a problem if the port mapping forwards to a exploitable service (old ssh service, some service with bruteforcable password, etc.) or if the router is exploitable in itself ---------------------------------------------------------------------- that_boi18 · 2023-11-13 03:08 Could you explain more about how Windows and Linux port forwarding differ? And by port forwarding on Linux do you mean iptables/nftables or something else? ---------------------------------------------------------------------- iavael · 2023-11-13 03:23 Nginx doesn't protect from bruteforce attacks. So as encryption with HTTPS. ---------------------------------------------------------------------- LavaCreeperBOSSB · 2023-11-13 03:29 Maybe not, but when used with a domain and using port 443, it makes sure that only traffic to the domain is allowed, which is a lot harder to discover than simple port scanning imo ---------------------------------------------------------------------- Cybasura · 2023-11-13 03:44 What are the actual security implications of opening your door wide when you leave for hours on end and not locking the door at all? :) ---------------------------------------------------------------------- Symnet · 2023-11-13 04:30 it's got to do with the software that is listening on that port. in a lot of cases it's not really a problem if you're running software that is supported and you keep it up to date. opening up port 80 or 443 to display a web application isn't really a risk by itself, but if that web application has RCE (remote code execution) vulnerabilities, then it's a much bigger risk. ---------------------------------------------------------------------- persiusone · 2023-11-13 05:00 If you are unwilling or unable to properly vet, secure, and monitor your exposed service- then you are contributing to a problem everyone else has to deal with because of your negligence. Port exposure is almost never needed for self hosted or home lab situations. You don't need to be a target to become a victim. Hackers look for places to launch attacks against others and to peddle child porn. Hackers don't care if the feds come to seize your hardware when its traced back to you because you got compromised by some jellyfin weakness you didn't anticipate There is a reason people do not recommend opening ports. I hope you think about this hard before going down this path. I hope you implement some kind of advanced intrusion prevention and web application firewalling also. If you just open a port and cross your fingers- you deserve to get hacked and have your equipment seized. ---------------------------------------------------------------------- JustNathan1_0 · 2023-11-13 05:13 Iirc it wasn’t even discovered in minecraft hut by a company but minecraft was dragged through the mud a lot because that’s where it was abused a lot ---------------------------------------------------------------------- JoeB- · 2023-11-13 05:55 I monitor port scans on my firewall and keep data for a rolling 12 month period. On average, a port is scanned (ie. probed) every 10 seconds, periodically bursting to 10 times per second. Some of these are benign web crawlers, but most are nefarious. Think of it like someone jiggling the front door knob of your home every 10 seconds to see if it is unlocked. If a port is found to be open, it certainly will be subject to further probing for vulnerabilities. As others have alluded to, an open port is an invitation. What’s behind it is critical and needs to be protected. If it is on your LAN and gets compromised, then everything on your LAN is at risk. ---------------------------------------------------------------------- sarinkhan · 2023-11-13 05:58 Well we could say that port forwarding as the implication that you are opening a door to something that can't be proven unbreakable. In the other hand, not forwarding the port keeps the door closed, and thus any exploit is blocked. So port forwarding definitely has an impact, weather the router is safe or not. Improbable things happen. Impossible things don't. ---------------------------------------------------------------------- cubernetes · 2023-11-13 06:09 Fair point, it's important to define a threat model. I was assuming a simple private consumer home network, there's little incentive for extensive attacks. If you're a company that's a whole different story and threat model, of course you would absolutely always be extremely mindful about which ports to open and to use well configured firewalls. ---------------------------------------------------------------------- JanBurianKaczan · 2023-11-13 06:42 if you're exposing hellyfin, just have a admin account accessible only from local network and all other accounts with 1-2 failed logins before they're locked. ---------------------------------------------------------------------- IKnow-ThePiecesFit · 2023-11-13 07:22 >Explain like im 16 (or something) * no open ports - cant get in * open ports - as if you put door somewhere in the wall, depending on doors quality they can get in easily or not at all ---------------------------------------------------------------------- bufandatl · 2023-11-13 07:57 The problem is a lot of people here are beginners and have no real clue about network security. And opening a port is opening a door. If you have a bouncer that clears people beforehand then you can keep the door open. But you will still need to keep your bouncer trained so he can take care of people you don’t want. Same with software. Keep it updated and have security enhancements in place like 2FA and analysis tools like crowdsec or fail2ban. And the open port might not an issue at all. But if you open a device like a NAS (*cough* QNAP *cough*) then you have a higher security risk. TLDR; if you know what you are doing it might not have implications. ---------------------------------------------------------------------- tomistruth · 2023-11-13 08:51 Mainly the tooling. Windows relies more on built in solutions with gui usage like Windows Firewall and RRAS, often involving extra licensing, while on Linux involves more scripting and allows more complex use cases from the start. ---------------------------------------------------------------------- lucaprinaorg · 2023-11-13 09:49 If you're confident to expose a machine on a VPS and you can manage the implications then you can manage a machine in a DMZ of your NAT/Firewall home router. If the server it's a bare metal UNIX than you're ok (i.e. \*BSD || \*Linux on a Raspberry Pi 4/5) , the basic install it's better than Fort Knox ---------------------------------------------------------------------- csandazoltan · 2023-11-13 10:33 Port forwarding is like putting your apartment number and name on the door of the apartment complex, so someone coming would know which apartment to go. This apartment is unlocked, it is the not "buzzing in kind" So even if someone wants to break in and finds your door, the security and safety of your door what matters. \--- Port forwarding in itself is "not" a security risk, if you are mindful, disable automatic port forwarding (uPnP) and open only the ports what is needed. The security risks come from the softwares that listen to an opened port. The internet itself is working on port forwarding, any website is port forwarded to the webserver on port 80,443 or 8080 by default. You are accessing a website right now. The security comes from the settings and safety of the webserver software itself. Whether it can be penetrated and access things that you are not supposed to. \--- If you are considering opening a service to the world you should look up if that software has any security vulnerabilities. Open source linux based software is better in this way, because many people tests the software and reports issues before it is released to stable version. You can also bild your server in a way, where things are separated. Like having a webserver in a container. The host is almost totally invisible from inside the container and it is nigh impossible (should be) to access the host computer other than the shared folders between host and container and you cannot navigate out of those folders. \--- The most secure will always be a totally closed firewall. But letting trusted softwares to be accessed from outside is not much less insecure. Do not trust what you see in movies, a "hacker" can't just waltz into your network, unless your router and firewall has some serious security vulerabilities or god forbid, public facing backdoors (some routers had some not so long ago, you should look up your own router for any news) ---------------------------------------------------------------------- rayjaymor85 · 2023-11-13 10:48 Port forwarding itself is not inherently dangerous; in much the same way that jumping out of a window is not inherently dangerous. But obviously it is risky. If you know what you're doing and mitigate the risk, jumping out of a window onto say a soft landing or a ground floor window is not a problem. Anyone hosting websites or services either at home or in a datacenter do it all the time. The dangerous part is if someone can do with that forwarded port if the service it's attached to can be used to gain access to something else on the network. Usually done by figuring out what you are running, and then exploiting a CVE to get in and then get access to the rest of your network that way. So as an example I have a VM with Google Cloud that is running my website. If someone does manage to hack it, well, who cares - it's just a VM running that simple LAMP stack. If I had that same website on my home network, and it can access my home NAS, well if it turns out there's a vulnerability I didn't account for then technically someone can take over that VM and hop into my NAS and do damage there. ---------------------------------------------------------------------- techotech111 · 2023-11-13 12:16 I was learning about web servers and deployed a simple hello world page and left port 80 open for a few days before realising I shouldn't be doing it. How can I know the damage it has caused? ---------------------------------------------------------------------- Low-Chapter5294 · 2023-11-13 12:49 You can train fail2ban to catch brute force attacks for many services. ---------------------------------------------------------------------- AviationAtom · 2023-11-13 13:11 Same level of risk as exposing anything in the Internet. Do you patch? Segment? Only expose what should be exposed? There's always ways to mitigate risk. Your average user isn't exposing much, so their risk is low. If you're going to expose stuff then you probably want to manage your risk. ---------------------------------------------------------------------- AviationAtom · 2023-11-13 13:12 SBOMs are a thing. Even if you didn't write the code when you include it you are accepting any vulnerablities as you own. ---------------------------------------------------------------------- winston198451 · 2023-11-13 13:14 A lot of great and valuable replies here so far. I'll add my comments anyway. I have learned over the years of selfhosting/homelabbing and being an IT professional that as u/emprahsFury stated, >Oftentimes though people don't know what they don't know, and we only find out that we don't know after we've moved from the prevention phase to the remediation phase. I have seen this for years professionally. Unless you think like the bad guy, you don't know what the bad guy is thinking. Not knowing what the bad guy is thinking does not mean that the techniques and possibilities do not exist. Taking some time to learn what the bad guys can do can be very helpful to the self-hoster in general. ---------------------------------------------------------------------- Symnet · 2023-11-13 13:25 hard for me to pick up on sarcasm so if you're being serious, the answer is you're probably fine ---------------------------------------------------------------------- Steve032D · 2023-11-13 13:32 Good question ---------------------------------------------------------------------- TheRealNetroxen · 2023-11-13 13:39 I won't reiterate what people have already said. What I will note, is that if you're exposing a port for an application, you should probably in most instances be proxying it through your webserver with the appropriate mitigations to common attack vectors. This could be something as simple as a deny_all or as thorough as CORS/CSRF checking. If you want an additional layer of security, use a gateway to redirect traffic to your webserver. ---------------------------------------------------------------------- techotech111 · 2023-11-13 13:44 Thank you, sorry if it sounded sarcastic. I was really serious. ---------------------------------------------------------------------- Symnet · 2023-11-13 13:50 no worries! happy to help :) ---------------------------------------------------------------------- bmelancon · 2023-11-13 14:08 As others have said, if you don't fully understand the implications of opening a port, you shouldn't open a port. Use something like TailScale or ZeroTier. You'll still be able to access your services but you don't need to open any ports. ---------------------------------------------------------------------- Yigek · 2023-11-13 14:19 What software do you monitor port scans with? I’m guessing like Opnsense firewall? ---------------------------------------------------------------------- mcr1974 · 2023-11-13 15:10 expose ssh only and tunnel all comms over it. but manual but ok for smaller projects. ---------------------------------------------------------------------- teem · 2023-11-13 16:07 I would also check out the OWASP top 10 specifically and attack surface management generally ---------------------------------------------------------------------- beagle_bathouse · 2023-11-13 18:33 Exposing your software to the internet resulting in initial access via: 1) Vulnerabilities being exploited (either 0 day or unpatched) 2) Credential stuffing or brute forcing credentials Then depending on the vulnerability or account compromised, access to your home network, move laterally, install ransomware, serve spam emails or links, or mine bit coin most likely. ---------------------------------------------------------------------- billiarddaddy · 2023-11-13 18:37 That depends on the port/service you're forwarding. It also depends on your ISP if they filter some standard ports. Non-standard ports can obfuscate your service, prevents it from being detected by crawlers and bots. Start small and don't ignore security standards. Patch your stuff. Use common sense. ---------------------------------------------------------------------- JoeB- · 2023-11-13 19:09 I use pfSense (similar to OPNsense) and send firewall logs as syslog to an Elasticsearch/Logstash/Kibana (ELK) server running in a VM. Logstash ingests the data, and performs some processing (ie. IP address based geolocation, translating port# to port#+service, etc.) before writing to Elasticsearch. Here is a screenshot of the Kibana [Firewall - Block Events](https://i.imgur.com/dfhqioi.png) dashboard for 12 months of data. ---------------------------------------------------------------------- dmdeemer · 2023-11-13 20:10 Once long ago, I left an SSH server exposed on port 22. The next day I found logs full of brute-force attempts. The end of the log indicated that the attacker(s) reached the end of their dictionaries with no success and gave up, but that was still the last time I left an SSH server on port 22. These days my only open port is a randomly-chosen UDP port for Wireguard. My understanding is that Wireguard doesn't even respond to an unauthenticated packet, so if you aren't sending ICMP port unreachable responses to closed ports, then it's essentially invisible. ---------------------------------------------------------------------- dmdeemer · 2023-11-13 20:21 It's more like installing a door where before was just a brick wall, and not watching to see who might come to pick the lock. Your larger point remains: not a good idea in general. ---------------------------------------------------------------------- dmdeemer · 2023-11-13 20:29 I'll repeat a reply I made as a top-level comment, as I think it's a useful analogy: Opening a port is like installing a door in what was a brick wall in a back alley, then leaving it unattended while people might try to pick the lock. Unfortunately, the internet is a crime-ridden neighborhood, and that lock will be tested, likely within minutes. The "door" in this analogy is a port forward on your router, and the "lock" is whatever security is provided by the service you expose on that port. Some services are battle-tested and more trustworthy than others, but nearly everything has a bug in it somewhere. I no longer leave any ports open, other than just one for Wireguard. Wireguard in general won't reply to unauthenticated packets at all, so it's essentially an invisible door. I can't speak to OpenVPN, it may or may not behave similarly. Leaving an SSH server visible is an invitation for automated password-guessing. ---------------------------------------------------------------------- Yigek · 2023-11-13 22:20 Nice. I’ll have to set this up myself. Thanks ---------------------------------------------------------------------- FoolHooligan · 2023-11-13 22:30 How do you do this? Is this possible through the Jellyfin UI? ---------------------------------------------------------------------- brisray · 2023-11-13 22:59 It looks like I've been doing it wrong for the last 20 years! I take some of the advice here in the same way that I find "never your give your IP address to anyone" overkill, especially as I've been running my public "Server in the Cellar" since June 2003. Some software I run needs some ports open, but those are the only ones I allow. Of course you have to take a bit of care doing things the way I do. The software, especially Apache, is hardened as much as I can. Not only to protect me but other users/visitors as well. The advice is to give as little information about the server away as possible. Opening ports mean it's practically a given what you're running. Once someone has that they can then attempt further probing looking for vulnerabilities. I purposely ignore that advice. My server status pages are public along with the output of the log analyzers I use. It's why my security rating isn't higher on the scanners I use, doing things like that are always flagged. Anything else they flag I'll read up on and try to mitigate. [Detectify](https://detectify.com/) once made an offer of making free scans which I took them up on. There are plenty of free Content Security Policy (CSP) and other vulnerability checkers around such as [Observatory](https://observatory.mozilla.org/) or [Pentest](https://pentest-tools.com/). [Shields UP!!](https://www.grc.com/intro.htm) will identify which ports you have open. Do people try and get out the public folders? Of course they do. I've had people,or mostly bots, doing that about 30 seconds after I first started the project. Am I completely invulnerable? Absolutely not. I am certain I won't be able to stop a determined attack by someone who knows what they are doing. My own advice is standard and would be: * Back up everything and often. * Don't put anything else on the computer you're using as a server apart from stuff you don't mind being made public. * Keep the software updated and patched. * Read whatever security bulletins the server software offer. * Learn to read log files, it's not always obvious what people are trying to do. ---------------------------------------------------------------------- paloalt · 2023-11-14 01:10 Coincidentally Ars Technica posted an article about a novel SSH protocol exploit using computation errors in RSA key exchange: https://arstechnica.com/security/2023/11/hackers-can-steal-ssh- cryptographic-keys-in-new-cutting-edge-attack/ I shouldn’t have said “very few” people expose port 22 - obviously it’s very very common. I should have said, you won’t find many seasoned self-hosters who’d recommend it as a practice, unless you have very strong intrusion protection countermeasures. ---------------------------------------------------------------------- JanBurianKaczan · 2023-11-14 07:05 yep, all through jellyfin ui ---------------------------------------------------------------------- FoolHooligan · 2023-11-14 20:59 Found the settings. Thanks! ---------------------------------------------------------------------- thomasbuchinger · 2023-11-15 12:15 For a Webserver/WebApp there are really 2 "levels" of potential security problems when exposed. The Webserver itself and the Application running on it. Because you used a standard port, your Webserver received random "attacks" from the internet. Most of those attacks target popular WebApps, like Wordpress and not the webserver itself. If you used a common webserver in a recent version, it's very unlikely anything happened. (A working exploit on a common webserver is the kind of thing, that cost a lot of money and isn't deployed on random IPs on the internet) For WebApps the biggest attack surface is it's login page. So brute- force attacks on it's password, SQL injection attempts and so on. WebApps have a lot less security effort out into them and very popular ones (like Wordpress) have a lot of effort put into finding attacks. For WebApps you want to put additional protections (as many as practical) in front of the sensitive parts. However a hello-world HTLM page has no attack surface, so nothing to worry about. --- Security is a trade-off between your value as a potential victim and the effort required to actually find a Security Hole ---------------------------------------------------------------------- techotech111 · 2023-11-15 14:34 Thank you for the detailed note ---------------------------------------------------------------------- icyhotonmynuts · 2023-12-03 17:22 The *or not* is what scares me. What tools can I utilize to test my own network without getting borked in the process?