{
  "port": 843,
  "protocol": "tcp",
  "service": "Flash socket policy server",
  "oneLiner": "Where Adobe Flash asked permission before opening a raw socket — a relic of a dead plugin.",
  "whatItIs": "Flash Player 9 and later required a cross-domain policy before a SWF could open a socket to a host: it connected to TCP 843 on that host, sent the literal string `<policy-file-request/>` followed by a NUL byte, and expected an XML policy document in reply. Sites running Flash chat, games or sockets-based apps therefore ran a tiny policy daemon such as flashpolicyd on 843 alongside the real service. The port was never IANA-registered — it was Adobe's convention. Flash reached end of life in December 2020, so a listener here today is a forgotten leftover process.",
  "exposure": {
    "verdict": "careful",
    "note": "The daemon only ever emits a static XML policy, but a permissive `<allow-access-from domain=\"*\"/>` was a real cross-domain hole; with Flash dead, the right move is to turn it off."
  },
  "checkCommand": "printf '<policy-file-request/>\\0' | nc TARGET 843",
  "links": [
    {
      "title": "flashpolicyd — Flash socket policy daemon (listens on 843)",
      "url": "https://github.com/ripienaar/flashpolicyd",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}