1

I've recently set up a home server and spent some time working on the security. One of the tools I've been using nmap which I pointed at my Windows 7 desktop. It showed an unknown service on port 10243. When I connected to the port with netcat it identified itself as Server: Microsoft-HTTPAPI/2.0?

Anyone know what this is or how I can find out? I've tried browsing it in firefox but nothing comes up.

[root@laptop]# nc 192.168.0.4 10243
get

HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 25 Jan 2013 19:28:53 GMT
Connection: close
Content-Length: 326

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid Verb</h2>
<hr><p>HTTP Error 400. The request verb is invalid.</p>
</BODY></HTML>

[root@laptop]# 
2
  • Do a "netstat -b" on the problem machine (or use TCPView from Sysinternals) to see what program is listening on that port.
    – Brian
    Jan 25, 2013 at 20:41
  • @Brian Thanks. TCPView show Process=System Pid=4 but cant get any process information?
    – James
    Jan 26, 2013 at 0:21

1 Answer 1

0

I had the same issue, but with the port 10,000, which was in conflict with Azure Emulator (it uses port 10,000 - 10,002). I don't know, how does it work exactly, but I'm guessing this:

WinHTTP is a Windows service, which can be used by 3rd party applications to communicate over HTTP. They can create a listening HTTP server on any port they like.

So if you need quick & dirty solution, you can just stop the service WinHTTP WPAD. It's possible, that it will close the listening servers, but it's also possible that 3rd party application will start it again after some time.

If you want some longer term solution, you should find which application is requesting a server on that port and then it depends on that application (you can reconfigure it, or just don't use it).

You can also check my answer on StackOverflow.com.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .