{
  "port": 987,
  "protocol": "tcp",
  "service": "Unassigned — commonly Windows SBS \"companyweb\" over HTTPS",
  "oneLiner": "Unassigned at IANA; when it is open it is usually a Windows Small Business Server publishing its internal SharePoint site.",
  "whatItIs": "IANA leaves 987 unassigned, in the same 954–988 gap as 981, and nmap lists it as unknown. Windows Small Business Server 2008 and 2011 bound the internal SharePoint site — companyweb — to HTTPS on port 987, reusing the certificate from the 443 site, and administrators opened 987 at the perimeter so Remote Web Workplace could link straight to it. SBS is long out of support, so a live 987 is either a surviving SBS box or an unrelated application that took a free port.",
  "exposure": {
    "verdict": "never",
    "note": "An internet-facing SharePoint front end on an out-of-support Windows Small Business Server is an unpatched application on an unpatched operating system, reachable pre-authentication."
  },
  "checkCommand": "openssl s_client -connect TARGET:987 </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry (954–988 unassigned)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "nmap-services (987/tcp unknown)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}