[vsmsamples]

Hello

I just installed Little Snitch and I was alerted to firefox trying to contanct a remote site hidden under seriall.com under port 8000 and 8081, this also happens at crackz.ws. (Windows users DO NOT go here as you will be infected upon site load!!) I assume these are http but what exactly are these ports for. I also notice this on every other exploit infested sites out there. This is strange because Little Snitch never alerts be about firefox trying to connect on port 8000 or 8081 on any websites except these two described above.

What is the function of 8000 and 8081?

Is this some convenient port that allows attacks to exploit more efficently then port 80? im so confused

[P]

Portnumbers over 1024 are not restricted in UNIX. This means that anyone can start a server that listens on these ports - 1023 and below are reserved for root, the administrator of the computer, on all UNIX systems. As a result, such numbers can be used by any service.

The IANA reference lists "iRDMI" for port 8000 and "Sun Proxy administrator" for 8081, but I don't think that's what's happening. I think they are simply alternate http ports - that the HTTP service is running on that port because port 80 (the regular port) is used for something else - probably another http daemon.

You can have Firefox, or any other browser, connect to a server on a different port by typing http://server.name:1234, where 1234 is the port number. I think this is what "cracks.ws" is doing - it's loading an image or a script or something from a server using a URL like that, with an explicit port assignment.

[ghporter]

A lot of "proxy/firewall avoiding" sites use port 8000, 8080, and others in that range to avoid being blocked or monitored. It's an old trick and it works when you need it-and the net admin is still thinking in the stone age. As you explain that these sites are bad for Windows users, I'm going to assume that they are using these ports specifically because some Windows users think they're getting something special out of this dodge. And from the URL (crackz.ws) it looks like it's good bait for the "something for nothing" crowd. Kinda sad...