Project Case Study
I performed a basic security assessment of an old ISP-provided consumer router in an isolated home-lab environment. The goal was to identify exposed local services, confirm the router's management surfaces, document the scan process, and review settings that affect the router's security posture.
Assess an old consumer router that I own and no longer use with my current service provider. I wanted to practise safe network reconnaissance, identify exposed services on the local gateway, and document the results in a professional format suitable for my cybersecurity portfolio.
The assessment was performed from my MacBook while connected to the old router's local network. I did not use my Proxmox Kali VM for this version because disconnecting the Proxmox server from my main network would interrupt access to the Proxmox web interface. For this first scan, the laptop and router were enough.
Testing machine: MacBookTooling: Terminal, Nmap 7.99, web browserTarget device: Old ISP-provided DOCSIS gateway/routerRouter IP: 10.0.0.1Laptop IP: 10.0.0.239Interface: en0Network: 10.0.0.0/24
route -n get default.ifconfig.10.0.0.1.The first scan confirmed that the router was reachable and exposing a small number of local services. Most TCP ports were filtered, which is a positive sign because unnecessary services were not openly responding to the local client.
nmap 10.0.0.153/tcp open domain80/tcp open http443/tcp open https49152/tcp open unknown996 filtered tcp ports
A targeted service scan identified DNS on port 53 and a router administration service on ports 80 and 443. Nmap reported the web service banner as Xfinity Broadband Router Server, while the browser login page displayed the Helix/Videotron gateway interface. Several
commonly risky services, including FTP, SSH, Telnet, SMB, AFP, and alternate web administration ports, appeared filtered during the
targeted scan.
nmap -sV -p 21,22,23,53,80,443,445,548,1900,5000,8080,8443,8888 10.0.0.153/tcp open domain dnsmasq 2.8380/tcp open http Xfinity Broadband Router Server443/tcp open ssl/https Xfinity Broadband Router Server21/tcp filtered ftp22/tcp filtered ssh23/tcp filtered telnet445/tcp filtered microsoft-ds548/tcp filtered afp1900/tcp filtered upnp5000/tcp filtered upnp8080/tcp filtered http-proxy8443/tcp filtered https-alt8888/tcp filtered sun-answerbook
Assessment Results
The router exposed expected gateway services on the local network: DNS and web-based administration. The scan also found an unknown high TCP port, which should be followed up with targeted service detection before drawing conclusions. Filtered results on Telnet, FTP, SSH, SMB, and alternate admin ports were documented as positive observations.
Finding 1
Evidence: 53/tcp open domain dnsmasq 2.83
Risk / meaning: This is expected for a router, but the DNS service should remain limited to the local network.
Recommendation: Keep DNS service internal and avoid exposing router services to the WAN.
Finding 2
Evidence: 80/tcp open http
Risk / meaning: Local users can reach the router login surface over HTTP.
Recommendation: Use a strong admin password and prefer HTTPS administration where supported.
Finding 3
Evidence: 443/tcp open ssl/https
Risk / meaning: Secure local web administration is available.
Recommendation: Use HTTPS for management and disable remote administration if available.
Finding 4
Evidence: 49152/tcp open unknown
Risk / meaning: This requires follow-up enumeration before deciding whether it is expected or unnecessary.
Recommendation: Run targeted service detection against port 49152 and document the result.
Positive observation
Evidence: FTP, SSH, Telnet, SMB, AFP, UPnP-related TCP ports, and alternate admin ports were filtered.
Risk / meaning: Unnecessary services were not openly exposed to the local client during testing.
Recommendation: Keep unused services disabled and review UPnP, WPS, and remote management settings.
Challenge
I originally planned to use my Kali VM inside Proxmox, but realized that disconnecting the Proxmox server from my main network would prevent me from reaching the Proxmox web UI from my laptop. I adjusted the plan and used Nmap directly from macOS instead.
Troubleshooting
A failed command, nmap -sv, helped confirm that Nmap options are case-sensitive. The correct command is
nmap -sV.
Clarification
I learned that ping -p 53 on macOS does not test port 53. It changes the ICMP payload pattern, while Nmap was the correct
tool for identifying port 53 as an exposed DNS service.
Value
This project demonstrates practical network reconnaissance, local gateway enumeration, command-line troubleshooting, and security documentation while keeping testing scoped to owned equipment in a controlled environment.
Scan Breakdown
The assessment followed a simple workflow: identify the gateway, confirm connectivity, scan exposed services, interpret the results, and document next steps.
Step 1
Used route -n get default and ifconfig to identify the router as 10.0.0.1 and confirm the
laptop's local address on the router network.
Step 2
Sent ICMP echo requests to the gateway and confirmed 0.0% packet loss, showing that the router was reachable before scanning.
Step 3
Ran a basic Nmap scan and targeted service detection to identify DNS, HTTP, HTTPS, and one unknown high port exposed on the local gateway.
Step 4
Converted raw scan output into structured findings with evidence, meaning, and recommended follow-up actions.
Command Log
These commands were run only against my own router on my local lab network.
Confirmed that Nmap was installed and available from the terminal.
nmap --version
Identified the default gateway used by the laptop while connected to the old router.
route -n get default
Confirmed the active interface, local IP address, and subnet details.
ifconfig
Verified that the router gateway responded before running service enumeration.
ping 10.0.0.1
Scanned common TCP ports on the router gateway.
nmap 10.0.0.1
Identified services and versions on selected router-relevant ports.
nmap -sV -p 21,22,23,53,80,443,445,548,1900,5000,8080,8443,8888 10.0.0.1
Evidence
These screenshots show the physical lab setup, local router login page, initial Nmap scan, and targeted service detection scan. Sensitive values such as MAC addresses, passwords, serial numbers, QR codes, and public/WAN details should be redacted before publishing.
Next Stage
Run nmap -sV -p 49152 10.0.0.1 to determine whether the exposed high port is expected router behaviour.
Check firmware version, WPS, UPnP, remote management, firewall settings, wireless encryption, and admin password status.
Apply safe hardening changes, then re-run the scan to compare the exposed service profile before and after remediation.