List of most common ports / open-frequency?

[drwetter]

Hi,

while doing some blind ssrf scanning in a container environment I thought it would be ok to just use the most common ports from nmap as the port parameter.

But I realized the most common ports I expected for this task aren't in there, even in the top 1000 (awk '$2~/tcp$/' /usr/share/nmap/nmap-services | sort -r -k3 | head -n 1000 | grep -Ew '6443|10250|10255|10251|10252|2379|2380')

Thus the question: how is the open-frequency in /usr/share/nmap/nmap-services being determined?

Cheers, Dirk

[drwetter]

FYI: Those are common ports in a Kubernetes and similar environments. They won't be scanned probably unless explicitly supplied:

dirks@laptop:~|0% awk '$2~/tcp$/' /usr/share/nmap/nmap-services | sort -r -k3 | grep -Ew '6443|10250|10255|10251|10252|2379|2380'
unknown 10255/tcp       0.000076
sun-sr-https    6443/tcp        0.000000        # Service Registry Default HTTPS Domain
etcd-server     2380/tcp        0.000000        # etcd server to server communication
etcd-client     2379/tcp        0.000000        # etcd client communication
apollo-relay    10252/tcp       0.000000        # Apollo Relay Port
dirks@laptop:~|0% nmap -v
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-14 13:54 CET
Read data files from: /usr/bin/../share/nmap
WARNING: No targets were specified, so 0 hosts scanned.
Nmap done: 0 IP addresses (0 hosts up) scanned in 0.06 seconds
dirks@laptop:~|0% 

I don't feel this is how it should be, since a long time.

[drwetter]

How old is the file and does it reflect the reality nowadays? Is that WAN statistics or from a LAN?