8333, 18333, 38333, 48333, 18444 - Pentesting Bitcoin
Basic Information
- 8333/TCP is Bitcoin Core’s default mainnet peer-to-peer port.
- 18333/TCP is the default testnet3 peer-to-peer port.
- 38333/TCP is the default signet peer-to-peer port.
- 48333/TCP is the default testnet4 peer-to-peer port.
- 18444/TCP is the default regtest peer-to-peer port.
These defaults come from Bitcoin Core’s chain parameters and can be overridden in a node’s configuration.[1] Bitcoin peer-to-peer traffic uses TCP.[2]
Default ports: 8333, 18333, 38333, 48333, 18444
PORT STATE SERVICE
8333/tcp open bitcoinShodan
port:8333 bitcoinUser-Agent: /Satoshi
Enumeration
Bitcoin peers exchange version and address messages as part of the peer-to-peer protocol. Nmap’s bitcoin-info script extracts version and node information, while bitcoin-getaddr asks a peer for known node addresses.[3][4]
sudo nmap -p 8333 --script bitcoin-info --script bitcoin-getaddr <IP>
PORT STATE SERVICE
8333/tcp open bitcoin
| bitcoin-info:
| Timestamp: 2022-04-08T22:33:58
| Network: main
| Version: 0.7.0
| Node Id: 1bea074ea4f6eca3
| Lastblock: 731027
|_ User Agent: /Satoshi:0.19.1/
sudo nmap -p 8333 --script bitcoin-getaddr <IP>
PORT STATE SERVICE
8333/tcp open bitcoin
| bitcoin-getaddr:
| ip timestamp
| 2a02:c7e:486a:2b00:3d26:db39:537f:59f2:8333 2022-03-25T07:30:45
| 2600:1f1c:2d3:2403:7b7d:c11c:ca61:f6e2:8333 2022-04-08T07:16:38
| 75.128.4.27:8333 2022-04-02T08:10:45
[...]