5357 Hacktricks: Port

Port 5357 is commonly used by Microsoft Windows for , specifically the Web Services on Devices API (WSDAPI). It allows devices like printers, scanners, and network shares to automatically discover each other on a local network using HTTP over TCP.

# Check if open nmap -p 5357 <target>

Port 5357 is the default TCP port for the protocol, a Microsoft implementation of the Devices Profile for Web Services (DPWS) . It was introduced in Windows Vista and is active by default in Windows 7, Windows 8, and Windows 10, especially when Network Discovery is enabled. port 5357 hacktricks

5357/tcp open http Microsoft HTTPAPI httpd 2.0 |_http-title: Service Unavailable |_http-server-header: Microsoft-HTTPAPI/2.0

A positive response typically reveals a Microsoft HTTPAPI httpd server (e.g., Microsoft HTTPAPI httpd 2.0 ). Manual HTTP Probing Port 5357 is commonly used by Microsoft Windows

If the service must remain active for local device discovery (such as office printing), ensure that Port 5357 is strictly blocked at the network perimeter firewall and restricted to trusted local subnets via the Windows Defender Firewall.

Port 5357 (TCP) is the default endpoint utilized by the Microsoft . WSDAPI is an implementation of the WS-Discovery protocol, designed to enable Windows assets to discover and communicate with web-service-enabled hardware—primarily network printers, scanners, and file shares—without manual configuration or central directory servers. It was introduced in Windows Vista and is

Port 5357 is officially allocated to – Web Services for Devices on Windows. It is part of Microsoft’s implementation of the Devices Profile for Web Services (DPWS) . Think of it as a "Plug and Play for the network" – devices (printers, scanners, media servers, IoT hubs) announce themselves and their capabilities via SOAP/HTTP.

WSDAPI (Web Services for Devices) / HTTP Commonly found on: Windows (Windows 7, 8, 10, Server editions) Protocol: HTTP (often REST-like SOAP/XML services)