A Windows Troubleshooting Case to Find out Unknown Service Running on Certain Port

A basic windows troubleshooting process to find out which service is running on a unknown tcp port. Our Qyalys Vulnerability found a machine has tcp 12345 opened on http service. It is unknown port and Qualys marked it as potential risk since it is same port as NetBus - a well known old Trojan software at early of 2000 year. To make sure it is not something hacking or virus infected case, I worked on some basic steps to identify which application is using this port and why. With some commands in Windows Command Prompt, and Google's help, I were able to use registry key change to disable http service and confirmed it was Printer Spooler service using http service. The whole process can be helpful if you are facing similar issue which is trying to identify unknown service running on certain port. Let me know if you have better ideas or suggestions. Subscribe me: https://www.youtube.com/c/Netsec?sub_confirmation=1 ======================================================= Recording IT life Blog: https://51sec.org