Pearson's OSCP Notebook

Port Knocking - knock

Properties1
tagsport-knocking, knock, knockd, hping3, nmap, ssh, hidden-services, recon

4 min read

Port Knocking — knock, knockd & Alternatives

Ctrl+F: knock · knockd · port sequence · 7000,8000,9000 · hidden SSH · nmap knock

What is port knocking?

Port knocking is a stealth access method: the server ignores connection attempts until you send packets to a specific sequence of closed ports in order (e.g. knock 7000 → 8000 → 9000, then SSH on 22 opens for ~30 seconds).

ComponentRole
knockdDaemon on target — watches for knock sequence, runs script (often iptables to open port)
knockClient on attacker — sends SYN to port sequence
SequenceOrdered ports + protocol (TCP/UDP) — must match config exactly

OSCP use: Full nmap -p- shows nothing on 22, but blog/docs mention “knock these ports first.” After correct knock → SSH or admin panel appears.

Install (Kali)

# Client
sudo apt install -y knockd
# knock binary is in the knockd package on Debian/Kali
 
# Alternative tools
sudo apt install -y hping3 nmap
which knock

→ Installation - Kali Setup

📌 1) knock client — send knock sequence

Syntax

knock <target> <port1> <port2> <port3> ...
knock -v <target> <ports>          # verbose
knock -d <ms> <target> <ports>     # delay between knocks (default 500ms)
knock -u <target> <ports>            # UDP knocks

Examples

# TCP knock sequence — then immediately SSH
knock 10.10.10.10 7000 8000 9000
ssh user@10.10.10.10
 
# Verbose (see each knock)
knock -v 192.168.1.50 1234 5678 9012
 
# Slower delay between knocks (knockd timing sensitive)
knock -d 1000 10.10.10.10 7000 8000 9000
 
# UDP sequence
knock -u 10.10.10.10 7000 8000 9000
 
# One-liner: knock + connect
knock 10.10.10.10 7000 8000 9000 && ssh -i id_rsa user@10.10.10.10

Common OSCP sequences (from enum / writeups)

knock TARGET 1 2 3
knock TARGET 7000 8000 9000
knock TARGET 1111 2222 3333
knock TARGET 1234 5678 9012

Finding the sequence: source code, /etc/knockd.conf if readable, comments in web app, .bash_history, CTF description.

📌 2) nmap — port knock via NSE / manual

Manual knock with nmap (send to closed ports)

# SYN to each port in sequence (TCP)
nmap -Pn -p 7000 --max-retries 0 --host-timeout 100ms TARGET
nmap -Pn -p 8000 --max-retries 0 --host-timeout 100ms TARGET
nmap -Pn -p 9000 --max-retries 0 --host-timeout 100ms TARGET
nmap -Pn -p 22 TARGET    # verify SSH now open

nmap knock script (if available)

nmap --script knock --script-args knock.openport=22,knock.knocks=7000,8000,9000 TARGET

📌 3) hping3 — alternative client

Useful when knock is not installed or you need fine-grained TCP flags:

# SYN to each port in sequence
hping3 -S -p 7000 -c 1 TARGET
hping3 -S -p 8000 -c 1 TARGET
hping3 -S -p 9000 -c 1 TARGET
 
# Then scan / connect
nmap -p 22 TARGET
ssh user@TARGET
# Bash loop — custom sequence
for port in 7000 8000 9000; do
  hping3 -S -p $port -c 1 -q TARGET
  sleep 0.5
done
ssh user@TARGET

📌 4) knockd — server side (post-exploit / understanding target)

Config usually at /etc/knockd.conf:

[openSSH]
    sequence    = 7000,8000,9000
    seq_timeout = 5
    start_command = /usr/sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    cmd_timeout = 10
    stop_command  = /usr/sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
FieldMeaning
sequencePorts client must hit in order
seq_timeoutMax seconds to complete full sequence
cmd_timeoutHow long port stays open after knock
%IP%Knocking client IP (iptables rule scoped to you)

Check if knockd is running (post-shell):

ps aux | grep knockd
cat /etc/knockd.conf
systemctl status knockd

📌 5) Detection & enumeration

# Before knock — SSH filtered/closed
nmap -p 22,80,443 TARGET
 
# After knock — SSH open (brief window)
knock TARGET 7000 8000 9000
nmap -p 22 TARGET
 
# Full scan may still miss knock — always grep source/docs for "knock"
grep -ri knock /var/www/html 2>/dev/null
SymptomLikely cause
SSH closed before knock, open afterPort knocking
Works once then closescmd_timeout expired — knock again
Never opensWrong sequence, wrong protocol (TCP vs UDP), wrong timing
Only your IP can connectiptables rule uses %IP%

📌 6) Full workflow (exam)

# 1. Discover target (local lab)
sudo netdiscover -i eth0
 
# 2. Scan — SSH closed
nmap -sC -sV -p- TARGET
 
# 3. Find knock sequence (web comment, knockd.conf, writeup hint)
knock -v TARGET 7000 8000 9000
 
# 4. Connect quickly (window is short)
ssh user@TARGET
# or
nmap -p 22 TARGET && ssh user@TARGET

→ netdiscover · SSH · Nmap

📌 Quick Cheat Sheet

# Client knock
knock TARGET 7000 8000 9000
knock -d 1000 -v TARGET 7000 8000 9000
knock -u TARGET 7000 8000 9000    # UDP
 
# hping3
for p in 7000 8000 9000; do hping3 -S -p $p -c 1 -q TARGET; sleep 0.5; done
 
# Verify + SSH
nmap -p 22 TARGET && ssh user@TARGET
 
# Read server config (if shell)
cat /etc/knockd.conf

Graph View

Backlinks