Outbound Egress Protocol & Firewall Hole Tester
Tactical 1-line PowerShell and Bash outbound egress scout. Rapidly cycle through candidate C2 ports (TCP 53, 80, 443, 8080, 8443), test recursive and direct UDP DNS resolution, detect Next-Gen Firewall TLS decryption (SSL bump), and export client-ready findings.
EGRESS SCOUT // TARGET & PROTOCOL ORCHESTRATION
Configure target reflector host, socket timeout thresholds, and auxiliary evasion inspection probes.
TARGET PORT SELECTION & OPERATIONAL PRESETS
Currently staged: 8 ports for simultaneous egress testing.
PowerShell 1-Liner (Compact Run)POWERSHELL
Instant command line string. Suitable for copy-pasting directly into cmd.exe, WinRM sessions, or low-privilege execution vectors.
powershell -nop -w hidden -c "$h='portquiz.net';53,80,443,853,8080,8443,8888,9001|%{$p=$_;$c=New-Object Net.Sockets.TcpClient;$t=$c.BeginConnect($h,$p,$null,$null);$s=$t.AsyncWaitHandle.WaitOne(800,$false);if($s -and $c.Connected){Write-Host '[+] TCP '+$p+' OPEN' -F Green}else{Write-Host '[-] TCP '+$p+' CLOSED' -F Red};$c.Close()}"PROTOCOL EGRESS RISK & C2 CHANNEL FEASIBILITY
Detailed security implications and threat actor viability for each tested egress port.
| Port / Protocol | Service Name | Risk Level | C2 / Tunnel Viability | Firewall Security Rationale |
|---|---|---|---|---|
| 53 / BOTH | DNS (Domain Name System) | CRITICAL | Elite - DNS tunneling bypasses 90% of proxies | Core DNS resolution. Direct outbound UDP/TCP 53 allows DNS tunneling & C2 (Iodine, dnscat2). |
| 80 / TCP | HTTP Cleartext | MEDIUM | High - universally supported, but inspectable | Unencrypted web traffic. Readily permitted but heavily subject to forward proxy inspection. |
| 443 / TCP | HTTPS / TLS | CRITICAL | Industry Standard - Default for 95% of C2 | Standard encrypted web traffic. Primary vector for modern HTTPS C2 (Mythic, Cobalt Strike, Sliver). |
| 853 / TCP | DNS over TLS (DoT) | HIGH | High - Encrypted covert transport | Dedicated encrypted DNS over TLS. Bypasses on-path DNS monitoring unless port is explicitly blocked. |
| 8080 / TCP | HTTP Alternate / Proxy | HIGH | Elite - Widely whitelisted in corporate firewalls | Universally allowed web caching and alt proxy port. Excellent secondary C2 listener. |
| 8443 / TCP | HTTPS Alternate | HIGH | Elite - Encrypted fallback channel | Commonly permitted secondary TLS port for enterprise applications, admin APIs, and C2. |
| 8888 / TCP | HTTP Alternate 2 | MEDIUM | High | Alternate web service port often permitted for internal tools or cloud monitoring. |
| 9001 / TCP | Tor Directory / Alt C2 | HIGH | High | Frequently used for customized C2 channels and Tor proxy relays. |
LIVE IN-BROWSER EGRESS & RESOLUTION DIAGNOSTIC
Active probe running within your current web browser session to test outbound HTTPS and DNS-over-HTTPS connectivity.
Cloudflare Edge Trace
https://1.1.1.1/cdn-cgi/trace
DNS-over-HTTPS (DoH Cloudflare)
https://cloudflare-dns.com/dns-query?name=example.com&type=A
DNS-over-HTTPS (DoH Google)
https://dns.google/resolve?name=example.com&type=A
Public API Gateway
https://api.github.com/zen
FIREWALL ENVIRONMENT PROFILES & C2 ARCHITECTURE MATCHING
Select an enterprise perimeter profile to examine diagnostic outputs and recommended C2 transport strategies.
FIREWALL ATTRIBUTE MATRIX: Tier-1 Enterprise (Zscaler / Palo Alto TLS Decryption)
All non-web ports (SSH, RDP, high ports) are dropped by stateful next-gen firewall. Port 443 undergoes full SSL bump/decryption, replacing upstream certs with internal corporate CA. Direct C2 binaries will fail TLS handshakes unless configured to trust local Windows cert store or use legitimate domain fronting.
RECOMMENDED C2 EVASION & TRANSPORT PROFILES
Custom Malleable HTTPS C2 with enterprise root CA pin bypass
Domain Fronting / Azure CDN worker endpoint
Internal Proxy NTLM/Kerberos authenticated relay
DNS TXT Tunneling (if recursive query payload permits)
Before deploying memory-resident beacons, always run the 1-liner egress scout. Discovering an open port like 8443 or a non-inspected DNS channel prevents implant burn and alerts from SOC next-gen firewall correlation rules.
Perimeter Egress Evasion Principles
1. SSL Bump / Decryption Bypass
Enterprises deploying Palo Alto, Zscaler, or Fortinet appliances intercept outbound port 443 TLS handshakes and re-sign them using an internal Root CA. Uncompiled implants or Golang/Rust agents that fail to inherit the Windows CryptoAPI store will immediately crash or alert SOC analysts. Always probe for enterprise cert issuers before launching beacons.
2. Covert DNS Tunneling Escape
In segmented environments (such as PCI enclaves or OT networks), all direct TCP/UDP routing to the internet is disabled. However, endpoints frequently retain the ability to resolve names via the internal Active Directory Domain Controller. If recursive queries reach external authoritative nameservers, tools like dnscat2 and iodine can tunnel bi-directional C2.
3. High-Risk SMB & NTLM Traps
Testing port 445 (SMB) outbound serves a dual purpose. If outbound TCP 445 is open, red teamers can coerce internal machine or service accounts to authenticate against an external Responder/ntlmrelayx listener, capturing NetNTLMv2 hashes without touching local disks.