TCP/UDP Ports in Penetration Testing: A Complete Guide from Recon to Exploit

When you run the first scan on a target, every open port is a potential attack vector. Open port 445 on a Windows domain? SMB relay and Pass-the-Hash. Redis on 6379 without authentication? RCE in two commands. Jupyter on 8888? Direct code execution without credentials. Knowing the attack vector of each exposed service is the difference between a methodical pentest and a blind pentest.

This guide collects all the TCP and UDP ports used in penetration testing, organized by attack scenario—not by port number. You'll find the AD ports together because in a Windows engagement, you attack them sequentially. The databases are separate because they have different toolsets. Network protocols come first because understanding how ARP or ICMP works changes the way you construct attacks.

The definitive reference for those preparing OSCPs, working on HTB ProLab, or performing assessments on real infrastructures. For tools to use on each port, consult the Complete Guide to Penetration Testing Tools.

# Scan completo — tutte le porte TCP
nmap -sV -sC -p- --open -oA fullscan 10.10.10.1

# Top 1000 — discovery veloce
nmap -sV --top-ports 1000 -oA top1000 10.10.10.1

# UDP — non ignorarlo mai
nmap -sU --top-ports 100 -oA udpscan 10.10.10.1

# Approfondimento su porta specifica
nmap -sV -sC -A -p 445 10.10.10.1

Index #

• Transport and Network Protocols
• Active Directory & Windows
• File Transfer & Remote Access
• Web Services
• Database
• Mail Services
• VPN & Proxy
• Network & Infrastructure
• DevOps & Cloud
• Legacy & Less Common
• Essential tools
• Related Hubs

Transport and Network Protocols #

Before ports, protocols. Understanding how TCP works at the handshake level, how ARP resolves addresses, or how ICMP behaves changes the way you construct attacks—from ARP poisoning for MITM, to stealthy SYN scan, to ICMP tunneling for exfiltration.

Transport and network #

LAN, switching and routing #

Network attack techniques #

Active Directory & Windows #

The most critical ports for AD pentesting. In a Windows domain, these ports define the entire attack surface. The typical sequence: enumerate on 389/LDAP, capture hashes on 137-139 with Responder, relay on 445/SMB, execute commands on 5985/WinRM or 135/RPC. Kerberos on 88 is the hub of everything.

File Transfer & Remote Access #

Anonymous FTP, clear Telnet, and unauthenticated NFS are still present in real-world environments and are a constant presence in OSCP and HTB labs. The most common vector for these services is trivial: default credentials or completely anonymous access. Always check them, even when they seem irrelevant.

Web Services #

Don't stop at 80 and 443 — Tomcat on the 8080, Jupyter on the 8888, and Webmin on the 10000 are often the fastest initial access vectors. Each exposed application server version has associated CVEs; always check the version before proceeding.

Database #

Often directly accessible on the internal network—misconfiguration, default credentials, no firewall between VLANs. Each DBMS has its own approach: know the specific commands before attacking.

Mail Services #

Mail servers expose cleartext credentials on ports 110 and 143, allow user enumeration via SMTP, and in AD environments are vectors for internal phishing and credential stuffing. Underestimated, often unpatched.

VPN & Proxy #

Ports found when an organization exposes remote access. Often misconfigured, often with weak PSKs or credentials. An open proxy is an immediate pivot vector to the internal network. In enterprise environments, misconfigured PPTP and OpenVPN are still common.

Network & Infrastructure #

SNMP on 161 with the community string "public" is still the most common finding in enterprise assessments. IPMI on 623 often leads to direct root on the BMC. Misconfigured DNS results in complete zone transfers. These ports are rarely monitored—use them for passive intelligence before any noisy actions.

DevOps & Cloud #

Containers, orchestrators, message brokers—the modern attack surface. Often accessible without authentication in misconfigured cloud environments or exposed dev servers in production.

Legacy & Less Common #

Ports you encounter on older systems, network devices, and legacy enterprise environments. Don't ignore them—they're often the most vulnerable because they're unmonitored and unpatched.

Essential tools #

Related Hubs #

For professional penetration testing on real infrastructures, discover HackIta's services.