{
  "port": 7001,
  "protocol": "both",
  "service": "Oracle WebLogic admin listen / AFS callback",
  "oneLiner": "Almost always Oracle WebLogic's default listen port; the registration belongs to AFS callbacks.",
  "whatItIs": "IANA assigns 7001 to afs3-callback, the port an AFS cache manager listens on so file servers can call back and invalidate cached data — AFS carries that over UDP via the Rx protocol. On TCP, what you find in practice is Oracle WebLogic Server: Oracle's Fusion Middleware port table lists 7001 as the default listen port for the Administration Server. That console and the T3 protocol behind it have been the subject of a long run of deserialization remote-code-execution advisories, which is why 7001 draws constant internet-wide scanning. Apache Cassandra also defaults its encrypted internode port (ssl_storage_port) to 7001.",
  "exposure": {
    "verdict": "never",
    "note": "A WebLogic admin listener on a public IP is an administrative plane with a long RCE history; keep it on a management network behind a proxy that terminates authentication."
  },
  "checkCommand": "curl -sI http://TARGET:7001/console",
  "links": [
    {
      "title": "Oracle Fusion Middleware — Default Port Numbers (WebLogic Admin Server 7001)",
      "url": "https://docs.oracle.com/en/middleware/fusion-middleware/12.2.1.4/asadm/port-numbers.html",
      "kind": "official-docs"
    },
    {
      "title": "OpenAFS Administration Guide",
      "url": "https://docs.openafs.org/AdminGuide/index.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 7001",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=7001",
      "kind": "iana"
    }
  ]
}