Infra Audit5 min readUpdated November 4, 2026

The Admin Panel You Forgot Is Listening Right Now

Nginx Proxy Manager on 81, Grafana on 3000, phpMyAdmin on 8080. Each is a public login page unless someone checked. We found our own on port 81.

ss -tlnp lists every listening port; compare against what should be public. Then check the reverse proxy: its own admin port and its routing rules are the surface everyone forgets.

ss -tlnp shows every listening socket with the process behind it. Anything bound to 0.0.0.0 or :: is a candidate for public reachability, filtered only by the firewall. The audit compares this list against the intended public surface and flags every extra listener, then verifies reachability with one HEAD request per candidate from outside.

See How We Work

In This Guide

The inventory

ss -tlnp shows every listening socket with the process behind it. Anything bound to 0.0.0.0 or :: is a candidate for public reachability, filtered only by the firewall. The audit compares this list against the intended public surface and flags every extra listener, then verifies reachability with one HEAD request per candidate from outside.
ss -tlnp shows every listening socket with the process behind it. Anything bound to 0.0.0.0 or :: is a candidate for public reachability, filtered only by the firewall. The audit compares this list against the intended public surface and flags every extra listener, then verifies reachability with one HEAD request per candidate from outside.

The reverse proxy trap

The proxy itself is the forgotten surface. Nginx Proxy Manager exposes its admin UI on port 81 by default, and small stacks leave it public. Worse, the proxy's routing rules can reach internal-only hosts: a request with the right Host header walks past the firewall through the front door.
The proxy itself is the forgotten surface. Nginx Proxy Manager exposes its admin UI on port 81 by default, and small stacks leave it public. Worse, the proxy's routing rules can reach internal-only hosts: a request with the right Host header walks past the firewall through the front door. The audit reads the proxy's routing config and probes each internal vhost with a single status-code request.

If it stays

The panel is a login page indexed by Shodan, with default credentials or a weak password behind it. The exposure window started when the panel was deployed. The fix is binding to localhost, a firewall rule, or VPN-only access, and the re-run of the same HEAD request expecting a timeout is the proof.
The panel is a login page indexed by Shodan, with default credentials or a weak password behind it. The exposure window started when the panel was deployed. The fix is binding to localhost, a firewall rule, or VPN-only access, and the re-run of the same HEAD request expecting a timeout is the proof.

Get the skill

The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times.
The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times. The full canary report is in the repository under docs/runs. Copy the skill into any coding agent, point it at your stack, and get the same report for your account.

4 Tips to Get Started

1

ss -tlnp | grep -v 127.0.0.1 is the inventory. Every line is a decision someone made once.

2

The reverse proxy's own admin port is the most commonly forgotten public surface on a small stack.

3

Check routing rules too: a public proxy routing by Host header can reach internal-only hosts.

4

Default credentials are the second half of the finding: admin panels ship with known defaults.

Ready to Stop Worrying About Infra?

Knowledge is the first step. Get a free 1-hour diagnostic and see where your infrastructure leaks time, money, and focus.

Related Guides

Is My S3 Bucket Public? How to Check in One Command

One command tells you if your S3 bucket is public, and one curl proves it. The policy check shows intent, the anonymous request shows reality.

The Most Common AWS Misconfiguration (It Is One Line of Config)

Public buckets and Principal * policies cause most disclosed AWS incidents. Each is one line of config with account-wide blast radius. Here is the pattern.

Terraform State File Leak: Every Secret in Plaintext

terraform.tfstate stores database passwords, IAM keys and TLS private keys in plaintext. sensitive=true hides nothing. Here is how leaks happen and the check.

Docker Socket Mounted in a Container: Root on the Host, No Exploit Needed

A container with /var/run/docker.sock mounted controls the host daemon and can mount your entire filesystem. No kernel exploit required. Here is the mechanism and the check.

R

Ron Cohen — DevOps engineer & founder, roqy.io

Content reviewed by the roqy.io team. Our guides are based on publicly available data.

Disclaimer: This content is for informational and educational purposes only. It does not constitute professional advice or a guarantee of specific results. Infrastructure needs vary by team, stack, and stage. Consult a qualified engineer for advice tailored to your situation.

Frequently Asked Questions

How do I find exposed admin panels on my server?

Run ss -tlnp and list every port bound to 0.0.0.0. Compare against what should be public. Then check the reverse proxy separately: its own admin port (Nginx Proxy Manager uses 81) and its routing rules. Verify each candidate with a single HEAD request from outside. We found our own NPM admin panel publicly reachable on port 81 this way.

Why are admin panels on non-standard ports still dangerous?

Port scanners cover the full range, not just 80 and 443. Shodan indexes non-standard ports continuously. A panel on 81 or 9090 is equally public, equally indexed, and often ships with default credentials that nobody changed because the port felt obscure.

What is the host-header routing trap?

A public reverse proxy that routes by Host header can forward requests to internal-only hosts. The proxy is legitimately public, so port scans see nothing wrong, but a request with the right Host header reaches an internal panel. Test with curl -sI -H 'Host: internal-host' https://your-proxy/ for each known internal vhost.

Get the DevOps Ecosystem Behind You

One accountable engineer. Full platform behind him. Month-to-month, no lock-in.

See How It Works