Network and IPC

Find localhost services, Unix domain sockets, and internal networks that were not visible externally. Methods for investigating listeners appear under Localhost Services and Unix Sockets and File Descriptors.

Commands to check

Additional check examples:

ss -lntup
ss -ant
ss -lxnp
ip addr
ip route
lsof -i
lsof -U

• Purpose: Find localhost listeners, Unix domain sockets, internal networks, and restrictions on connecting clients.
• Prerequisites: In minimal containers without ss, ip, or lsof, read /proc/net/tcp directly.
• What to inspect: 127.0.0.1:<port>, 0.0.0.0:<port>, *:3000, Unix socket owners, groups, permissions, and restrictions on connecting clients.
• Expected output: A service running as root on 127.0.0.1:1337, an admin UI on 127.0.0.1:7777, or /run/<app>/mgmt.sock.
• Interpretation: Listening on localhost prevents direct external connections. Another user on the same host may still connect, as may a user through an SSH tunnel.
• If a check fails: Distinguish IPv4 from IPv6, container network namespaces, firewalls, authentication, and non-HTTP protocols.
• Alternative commands: cat /proc/net/tcp, cat /proc/net/tcp6, nc -vz 127.0.0.1 <port>, curl -v --max-time 3.
• State change: ss and ip are read-only. nc or curl may leave connection records in target service logs. Do not repeatedly send input to an unknown protocol.

Reading /proc/net/tcp

cat /proc/net/tcp

A line with st equal to 0A means LISTEN. Addresses and ports are hexadecimal, and IPv4 address bytes appear in little-endian order. In a container without ss, convert them with Python or awk. The UID is the effective UID at socket creation (proc_pid_net(5)). To identify the running process, match its inode against /proc/<PID>/fd.

Classify listeners

Appearance	Interpretation	Next
A localhost process running as root provides HTTP administration	Check the executing user and authentication	Localhost Services
A printing port and /run/<app>/*.sock exist	Relate the root daemon to the socket owner	Unix Sockets
Localhost does not return HTTP	Find a client for the custom protocol; a failed curl does not prove it is unreachable	Localhost Services
HTTP is visible only inside a container	It may provide a path to reading files; check which user runs the listener	Localhost Services
Built-in HTTP server running as root	Find the served directory from startup arguments	Processes and systemd

If you capture internal network traffic with tcpdump, record the executing user and whether the network namespace was shared with the host. Capturing traffic alone does not establish host root privileges.

After gaining access, revisit ports marked filtered by an external scan and classify them here. Start with Externally Exposed Services.