Port 808 – HTTP-ALT (CCProxy HTTP)

Port 808 is a registered HTTP-ALT port, best known as the default HTTP proxy port for CCProxy — the Youngzsoft Windows proxy that IANA’s registry even names the port after (ccproxy-http). In the real world, though, the single most common reason TCP 808 is open is Microsoft’s Net.Tcp Port Sharing Service (SMSvcHost.exe): 808 is the default port for WCF net.tcp bindings, so Windows quietly opens it for .NET services and AD FS without anyone choosing it. When you find 808 answering, the first job is to work out which of these it is — a CCProxy HTTP proxy, a net.tcp/WCF endpoint, or just another web app parked on an alternate HTTP port — because the exposure is completely different in each case.

Why It’s Open

Three very different things park on 808:

• CCProxy. Youngzsoft CCProxy is a lightweight Windows proxy that shares one internet connection across a LAN. Out of the box it listens on 808 for HTTP (and 1080 for SOCKS), so any host running it exposes an alternate-HTTP proxy on this port. It’s old software, still found on small-office and lab networks.
• Microsoft net.tcp / WCF. 808 is the default port for WCF’s net.tcp binding, and the Net.Tcp Port Sharing Service (SMSvcHost.exe) binds it so multiple .NET services can share the port. This is why “why is port 808 open by default?” is the top question people ask about it — it’s Windows, not CCProxy. AD FS also uses net.tcp on 808 internally.
• Alternate HTTP / admin panels. Like 8080, 808 is a convenient non-privileged port for a web app or management UI to sit on when 80 is taken. Fingerprint it and treat it like any other web port.

Common Risks

• Open-proxy abuse. A CCProxy instance with no authentication lets anyone relay traffic through it — to anonymize attacks, launder scans, or send spam. Your host becomes the apparent source.
• Internal-network pivot (SSRF-style). An open proxy can be pointed at private IPs and internal services the attacker can’t otherwise reach, turning the proxy into a window onto the LAN.
• Legacy CCProxy remote code execution. CCProxy 6.2 and earlier carry remote buffer-overflow bugs (CVE-2004-2416, CVE-2004-2685) that are one long request away from a shell — and the software is effectively unmaintained.
• Cleartext proxy traffic. A plain HTTP proxy on 808 offers no transport encryption; credentials and requested URLs can be sniffed, and proxy logs may leak internal hostnames and IPs.
• Exposed net.tcp/WCF surface. A reachable WCF net.tcp endpoint is an application attack surface in its own right — unauthenticated service methods and .NET deserialization issues have both produced real RCE. It shouldn’t be exposed beyond the hosts that need it.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service and version

nmap -sV -p 808 <target>

The banner is what tells CCProxy, a net.tcp service, and a generic web app apart — don’t assume it’s a proxy just because the port is 808.

Test for an open HTTP proxy

nmap -p 808 --script http-open-proxy <target>

curl -x http://<target>:808 http://example.com/

A 200 OK for a site you didn’t host means the proxy is forwarding for you — confirm whether it also reaches internal addresses.

Test proxy authentication

curl -x http://user:password@<target>:808 http://example.com/

Metasploit (CCProxy overflow)

msfconsole -q
use exploit/windows/proxy/ccproxy_telnet_ping
info

This module targets CCProxy’s Telnet proxy (default TCP 23), not the HTTP listener on 808 — but it confirms the same vulnerable CCProxy build an admin exposed on 808. Fingerprint the version before assuming anything is exploitable.

Log every open instance, working proxy, and confirmed version as you go so it lands in the final pentest report instead of a scratch terminal.

What to Look For

Known CVEs and Exploits

• CVE-2004-2416 — Buffer overflow in the logging component of Youngzsoft CCProxy: a long HTTP GET request lets a remote attacker execute arbitrary code. This is the vector that touches the HTTP proxy path on 808. CVSS 2.0 7.5 (High).
• CVE-2004-2685 — Buffer overflow in CCProxy 6.2 and earlier via a long address in the ping (p) command to the Telnet proxy service (a different vector than CVE-2004-2416). CVSS 2.0 7.5 (High). Weaponized as Metasploit’s exploit/windows/proxy/ccproxy_telnet_ping and archived on Exploit-DB (621, Metasploit port 4360) — it hits the Telnet proxy, not 808 directly, but the same install exposes both.
• Design-level, not a single CVE. The durable risk on 808 is architectural: an unauthenticated CCProxy is an open proxy that relays traffic and can reach internal hosts, and an exposed WCF net.tcp endpoint is an application surface (unauthenticated methods, .NET deserialization). Treat an open 808 as a reason to identify and audit whatever is behind it, not as a guaranteed exploit.

Mitigation

• Identify what’s actually on 808 first. CCProxy, a net.tcp/WCF service, and a web app all need different fixes — fingerprint before you remediate.
• If it’s CCProxy: patch or, better, replace it (the codebase is old and effectively unmaintained), require proxy authentication, restrict it to the LAN, and never expose it to the internet.
• If it’s a web/admin panel: put it behind authentication and TLS and harden it like any HTTP / HTTPS service.
• If it’s net.tcp/WCF: restrict the endpoint to the hosts that use it, keep .NET patched, and disable the Net.Tcp Port Sharing Service where it isn’t needed so Windows stops binding 808.
• Firewall TCP 808 to management or client ranges, then rescan to confirm the port is no longer reachable from untrusted networks.

Real-World Example

CCProxy is a neat illustration of how an “internal convenience” service becomes a target. Back in 2004, researcher Patrick Webster published a remote buffer overflow in CCProxy 6.2’s ping command (CVE-2004-2685); it was folded into Metasploit as ccproxy_telnet_ping and still ships today, so a proxy meant only to share an office internet connection was one crafted request away from a SYSTEM shell — and, left unauthenticated, was also an open relay anyone could route through. The modern twist is the opposite problem: most port-808 listeners now belong to Windows’ own Net.Tcp Port Sharing Service, which is exactly why administrators keep asking why the port is open “by default.” Both cases share one lesson — don’t accept an open 808 at face value; fingerprint it, decide whether it’s a proxy, a net.tcp service, or a web app, and lock it down accordingly.

FAQ

What is port 808 used for?

Port 808 is a registered alternate-HTTP port (IANA name ccproxy-http). It’s the default HTTP proxy port for Youngzsoft CCProxy, and it’s also the default port for Microsoft’s net.tcp/WCF bindings via the Net.Tcp Port Sharing Service — so an open 808 is usually one of those two, or a web app parked on a non-standard port.

What service runs on port 808?

Most often either CCProxy (a Windows HTTP/SOCKS proxy) or a .NET net.tcp/WCF service managed by SMSvcHost.exe. Fingerprint the banner to tell them apart, because they carry very different risks.

Is port 808 dangerous?

It depends on what’s behind it. An unauthenticated CCProxy is a genuine risk — it can be abused as an open proxy and older builds have remote-code-execution bugs. A Windows net.tcp listener is usually a benign default, but it still shouldn’t be exposed to the internet. Either way, treat an externally reachable 808 as something to investigate.

Why is port 808 open on my Windows machine, and how do I close it?

That’s almost always the Net.Tcp Port Sharing Service (SMSvcHost.exe), which binds 808 for WCF net.tcp services. If nothing on the host needs net.tcp port sharing, set the service to Disabled and it will stop listening; otherwise firewall TCP 808 to the hosts that use it and rescan to confirm.

TL;DR

• Service: HTTP-ALT — CCProxy HTTP proxy (ccproxy-http) or Microsoft net.tcp/WCF
• Default port: 808/TCP (CCProxy also uses 1080 for SOCKS)
• Biggest risk: unauthenticated open proxy + legacy CCProxy RCE (CVE-2004-2416 / CVE-2004-2685); exposed net.tcp/WCF surface
• Mitigation: fingerprint what’s on 808, patch/replace or authenticate CCProxy, restrict net.tcp, and firewall the port