{
  "port": 683,
  "protocol": "tcp",
  "service": "CORBA IIOP",
  "oneLiner": "The registered port for CORBA's Internet Inter-ORB Protocol, though most ORBs never actually use it.",
  "whatItIs": "IIOP is the on-the-wire mapping of CORBA's GIOP messages onto TCP, used by object request brokers to invoke methods on remote objects. IANA registered 683 for it, but in practice ORBs bind an arbitrary high port and publish it inside the object reference (IOR), so a CORBA deployment rarely has anything listening here. When you do see 683 open it is usually an enterprise Java or C++ middleware stack that was explicitly configured to the registered port. Anything answering it speaks a binary protocol with no authentication of its own.",
  "exposure": {
    "verdict": "never",
    "note": "CORBA method invocation is a remote-code surface with no built-in authentication unless CSIv2/SSL was configured; keep ORBs on internal networks."
  },
  "checkCommand": "nmap -sV -p 683 TARGET",
  "links": [
    {
      "title": "OMG CORBA specification (GIOP/IIOP)",
      "url": "https://www.omg.org/spec/CORBA/",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}