{
  "port": 10000,
  "protocol": "both",
  "service": "NDMP / Webmin",
  "oneLiner": "Registered to NDMP backup traffic, but on a Linux box it is nearly always Webmin's root-level web console.",
  "whatItIs": "IANA assigns 10000 to NDMP, the Network Data Management Protocol that backup software uses to drive NAS filers and tape libraries. The listener you far more often meet is Webmin: its installer writes `listen=10000` into miniserv.conf and serves the administration UI over HTTPS there. Older macOS used 10000 for AirPort admin, which is why Nmap's database carries three names for it at once. At about 1.2% of scanned hosts open, it is one of the most commonly found ports above 9000.",
  "exposure": {
    "verdict": "never",
    "note": "Webmin is a root-equivalent web console with a history of pre-auth remote code execution (CVE-2019-15107 among others), and NDMP's base authentication is cleartext. Put either behind a VPN, not a public IP."
  },
  "checkCommand": "curl -skI https://TARGET:10000/",
  "links": [
    {
      "title": "webmin/webmin — setup.sh sets the default listen port to 10000",
      "url": "https://github.com/webmin/webmin",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 10000 (ndmp)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=10000",
      "kind": "iana"
    }
  ]
}