Networking Category

Port by port, service by service: what to expect, what to try, and which exploits to remember for each protocol.

blog
173+ Note
Focus
OSCP · Red Team
Structure
Recon → Exploit
Networking Category -

Networking blog

Filters

  • TFTP (Port 69/UDP): Enumeration, Exploitation, and Security
    networking

    TFTP (Port 69/UDP): Enumeration, Exploitation, and Security

    TFTP over UDP 69: A Practical Guide to Enumeration, Files, Configurations, Vulnerabilities, Cleartext Traffic, and Risks in Internal Networks.

    Discover more Discover more
  • DDoS: What it is, how it works, and how to test your defenses
    networking

    DDoS: What it is, how it works, and how to test your defenses

    What is a DDoS attack and how does it work? Learn about DDoS types, attack techniques, authorized testing, and how to verify the effectiveness of your defenses.

    Discover more Discover more
  • WAN Penetration Testing: VPN, IPsec, MPLS and SD-WAN
    networking

    WAN Penetration Testing: VPN, IPsec, MPLS and SD-WAN

    WAN penetration testing guide: Analyze VPN, IPsec, MPLS, and SD-WAN, identify tunnel vulnerabilities, and verify WAN infrastructure security.

    Discover more Discover more
  • MS08-067: what is it, RCE Windows and Metasploit exploits
    networking

    MS08-067: what is it, RCE Windows and Metasploit exploits

    MS08-067: What it is, how it works, and why it's one of the most notorious Windows RCEs. Learn about Server Service, NetAPI, SMB, Metasploit, detection, and mitigations.

    Discover more Discover more
  • FTP Bounce Attack: What It Is, How It Works, and How to Prevent It
    networking

    FTP Bounce Attack: What It Is, How It Works, and How to Prevent It

    FTP Bounce Attack: What it is, how the PORT command works, why it can enable indirect port scanning, and how to detect and prevent it.

    Discover more Discover more
  • Scapy Python: Packet Crafting, Sniffing, and ARP Spoofing
    networking

    Scapy Python: Packet Crafting, Sniffing, and ARP Spoofing

    Learn Scapy with Python to create and parse TCP, UDP, ICMP, and ARP packets, perform SYN scans, sniffing, ARP spoofing, and test firewalls and IDSs.

    Discover more Discover more
  • Port 2375 Docker API: Enumeration, RCE, and Hardening
    networking

    Port 2375 Docker API: Enumeration, RCE, and Hardening

    Port 2375 Docker API pentest: Test unauthenticated access, get RCE and root on the host, and apply detection, TLS, firewall, and hardening.

    Discover more Discover more
  • SIP and RTP Pentesting: VoIP Security, Attacks, and Tools
    networking

    SIP and RTP Pentesting: VoIP Security, Attacks, and Tools

    A practical guide to SIP and RTP pentesting: VoIP enumeration, authentication, traffic analysis, RTP injection, operational tools, and defenses with TLS and SRTP.

    Discover more Discover more
  • HTTP Port 80: Operational Guide (Ports/Protocols) in Pentesting
    networking

    HTTP Port 80: Operational Guide (Ports/Protocols) in Pentesting

    Port 80 in pentest lab: scan, HTTP fingerprint, vhost enum, directory brute force, misconfig and detection. Workflow with Nmap/ffuf/curl.

    Discover more Discover more
  • SSH Pentesting Guide: Tunneling, Pivoting, and Offensive Operations
    networking

    SSH Pentesting Guide: Tunneling, Pivoting, and Offensive Operations

    Learn how to pentest SSH from an offensive perspective: enumeration, brute force, port forwarding, SOCKS pivoting, file transfer, and agent hijacking for authorized red team engagements.

    Discover more Discover more
  • ntlmrelayx: NTLM Relay Attack - Setup and Bypass 2026
    networking

    ntlmrelayx: NTLM Relay Attack - Setup and Bypass 2026

    Complete guide to the NTLM Relay Attack with ntlmrelayx: coercion (PetitPotam, PrinterBug), SMB/LDAP/ADCS relay (ESC8), RBCD, Shadow Credentials, and DCSync. Internal network to Domain Admin workflow.

    Discover more Discover more
  • Splunk Pentesting: CVE-2024-36991, RCE and SYSTEM on 8089
    networking

    Splunk Pentesting: CVE-2024-36991, RCE and SYSTEM on 8089

    Complete guide to Splunk pentesting: Exploit CVE-2024-36991, recover credentials via splunk.secret, obtain RCE via malicious app, and scale to SYSTEM or root.

    Discover more Discover more
  • TCP/UDP Ports in Penetration Testing: A Complete Guide from Recon to Exploit
    networking

    TCP/UDP Ports in Penetration Testing: A Complete Guide from Recon to Exploit

    All TCP and UDP ports in penetration testing, organized by attack scenario: Active Directory, web, database, mail, DevOps. Attack vectors and complete technical guides for OSCP and red teams.

    Discover more Discover more
  • ICS/OT Pentesting: A Complete Guide to SCADA, PLC, and Industrial Protocols
    networking

    ICS/OT Pentesting: A Complete Guide to SCADA, PLC, and Industrial Protocols

    Complete guide to ICS/OT penetration testing: Modbus, S7, DNP3, BACnet, EtherNet/IP protocols. GRASSMARLIN tools, pymodbus, python-snap7, ISF, IndustrialXPL-Forge. CVE 2024-2025 and real attacks.

    Discover more Discover more
  • Port 137 NetBIOS: Responder, NTLM Relay, and Credential Theft on AD
    networking

    Port 137 NetBIOS: Responder, NTLM Relay, and Credential Theft on AD

    NetBIOS on port 137 enabled? Responder captures NTLMv2 hashes in minutes, ntlmrelayx executes commands without cracking. Chain from NBT-NS poisoning to Domain Admin for pentest.

    Discover more Discover more
  • Port 138 NetBIOS Datagram: Windows Broadcast Service Penetration Testing Guide
    networking

    Port 138 NetBIOS Datagram: Windows Broadcast Service Penetration Testing Guide

    Port 138 open? The attack surface is minimal in 2026, but it indicates NetBIOS is enabled. Focus on port 137 with Responder and 445 with SMB—those are the real vectors.

    Discover more Discover more
  • RPCbind Port 111: NFS Mount, UID Bypass and NIS Credential Dump
    networking

    RPCbind Port 111: NFS Mount, UID Bypass and NIS Credential Dump

    RPCbind on 111? Enumerate NFS and NIS with rpcinfo, mount anonymous shares, bypass root_squash with UID matching, and steal SSH keys or password hashes. Chain to root in minutes.

    Discover more Discover more
  • Door 113 Ident: What It Is and What to Do if You Find It Open in 2026
    networking

    Door 113 Ident: What It Is and What to Do if You Find It Open in 2026

    Port 113 open? Ident is nearly defunct, but it reveals usernames and points to vulnerable legacy systems. Learn how to enumerate and what to look for next.

    Discover more Discover more
  • NNTP Port 119: A Guide to Penetration Testing the Network News Transfer Protocol
    networking

    NNTP Port 119: A Guide to Penetration Testing the Network News Transfer Protocol

    Port 119 open? NNTP is nearly defunct, but it can expose newsgroups with cleartext credentials, usernames, and confidential data. Learn how to enumerate and exploit it.

    Discover more Discover more
  • Windows RPC Port 135: Null Session, WMI Exec, and Lateral Movement AD
    networking

    Windows RPC Port 135: Null Session, WMI Exec, and Lateral Movement AD

    Port 135 open? Enumerate users with null sessions and RID cycling, run commands via WMI/DCOM with Impacket, and reach Domain Admin in 42 minutes. Complete AD pentest guide.

    Discover more Discover more
  • Port 139 NetBIOS Session: Null Session, EternalBlue, and SMB Relay on AD
    networking

    Port 139 NetBIOS Session: Null Session, EternalBlue, and SMB Relay on AD

    Port 139 open? Enumerate users with null sessions, exploit MS17-010 over SMBv1, and use ntlmrelayx if signing is disabled. Chain a Domain Admin in 27 minutes.

    Discover more Discover more
  • DHCP Port 67: Rogue Server, Starvation, and MITM on the Internal Network
    networking

    DHCP Port 67: Rogue Server, Starvation, and MITM on the Internal Network

    Port 67 without DHCP snooping? Deploy a rogue server with dnsmasq, poison gateways and DNS, capture NTLMv2 hashes with Responder, and get to Domain Admin in 90 minutes.

    Discover more Discover more
  • Port 95 SUPDUP: Remote Terminal Protocol Deprecated (Historical Relevance)
    networking

    Port 95 SUPDUP: Remote Terminal Protocol Deprecated (Historical Relevance)

    Port 95 open during a scan? SUPDUP has been defunct since the 90s. Learn how to identify the real service: hidden web server, custom app, or honeypot.

    Discover more Discover more
  • Port 49 TACACS+: Shared Secret Crack and Network Takeover Cisco
    networking

    Port 49 TACACS+: Shared Secret Crack and Network Takeover Cisco

    TACACS+ on Route 49 with a weak shared secret? Bruteforce the key, decrypt the traffic with Wireshark, and take control of every router, switch, and firewall in the Cisco infrastructure.

    Discover more Discover more
  • PointCast Gate 90: What It Is and What to Do If You Find It Open in 2026
    networking

    PointCast Gate 90: What It Is and What to Do If You Find It Open in 2026

    Port 90 open during a scan? PointCast has been dead since 2001. Learn how to identify the real service, whether it's a hidden web server, proxy, or custom app.

    Discover more Discover more
  • Port 37 Time Protocol: OS Fingerprinting and Recon on Legacy Systems
    networking

    Port 37 Time Protocol: OS Fingerprinting and Recon on Legacy Systems

    Port 37 open? Time Protocol reveals OS (Windows Server 2003/2008, Cisco IOS), timestamp, and uptime. Immediate red flag for legacy technology—chain to EternalBlue in 15 minutes.

    Discover more Discover more
  • WINS Port 42: Complete Map of Windows Network Without Authentication
    networking

    WINS Port 42: Complete Map of Windows Network Without Authentication

    WINS on port 42 without authentication: enumerates domain controllers, file servers, and logged-in users via NetBIOS. Instant red flag for legacy Windows—chain to AD in 20 minutes.

    Discover more Discover more
  • Port 27018 MongoDB Cluster: Accessing Internal Nodes and Oplog Dump
    networking

    Port 27018 MongoDB Cluster: Accessing Internal Nodes and Oplog Dump

    Port 27018 exposed? Connect directly to the replica set secondaries, read the oplog with cleartext password, bypass the keyfile, and pivot into cluster nodes.

    Discover more Discover more
  • Port 28017 MongoDB HTTP: Information Disclosure and REST API Without Auth
    networking

    Port 28017 MongoDB HTTP: Information Disclosure and REST API Without Auth

    Port 28017 open? Read version, hostname, and logs without credentials, dump data via REST API, and pivot to 27017. Only on legacy MongoDB ≤ 3.4, often unpatched.

    Discover more Discover more
  • RDP Port 33389: Finding and Exploiting RDP on Non-Standard Ports
    networking

    RDP Port 33389: Finding and Exploiting RDP on Non-Standard Ports

    RDP moved to 33389? nmap -sV finds it in seconds. BlueKeep, Pass-the-Hash, and brute force work identically. Changing ports isn't security—it's a placebo.

    Discover more Discover more
  • Port 50000 SAP NetWeaver: from SAP* Default to RCE on ERP Enterprise
    networking

    Port 50000 SAP NetWeaver: from SAP* Default to RCE on ERP Enterprise

    SAP Management Console on 50000 without auth: Enumerate versions, exploit RECON (CVSS 10), abuse RFC with SAP*/06071992 and get OS command execution on all ERP data.

    Discover more Discover more
  • Port 50070 Hadoop NameNode: Download Petabytes of Data and RCE via YARN
    networking

    Port 50070 Hadoop NameNode: Download Petabytes of Data and RCE via YARN

    HDFS without Kerberos on 50070? Browse the filesystem, download CDRs and PIIs via WebHDFS with user.name=hdfs, then get a shell to the cluster via the YARN REST API.

    Discover more Discover more
  • ActiveMQ Port 61616: CVE-2023-46604 RCE Pre-Auth and admin Credentials:admin
    networking

    ActiveMQ Port 61616: CVE-2023-46604 RCE Pre-Auth and admin Credentials:admin

    Unpatched ActiveMQ on 61616? CVE-2023-46604 gives root shell in 8 seconds via OpenWire. Web console with admin:admin, messages with JDBC credentials, and lateral movement to Oracle.

    Discover more Discover more
  • Memcached Port 11211: Pentest and Data Dump 2026
    networking

    Memcached Port 11211: Pentest and Data Dump 2026

    Memcached opened without authentication: dump session token, credentials, and JWT with nc. 51.000x UDP amplification, cache poisoning, and hardening explained.

    Discover more Discover more
  • Port 15672 RabbitMQ: guest:guest to RCE with Erlang Cookie
    networking

    Port 15672 RabbitMQ: guest:guest to RCE with Erlang Cookie

    RabbitMQ management exposed on 15672? With guest:guest, read every message in the queue, dump hashes, and get RCE via Erlang cookies. Practical offensive guide.

    Discover more Discover more
  • Port 16010 HBase: Dump Billions of Records Without Authentication
    networking

    Port 16010 HBase: Dump Billions of Records Without Authentication

    HBase Master UI on 16010 without authentication: enumerate tables, dump data via REST API and Thrift, read tokens and CDRs. Full pentest with scan, Hadoop lateral movement.

    Discover more Discover more
  • MongoDB Port 27017: Passwordless Access, NoSQL Injection, and Data Dumps
    networking

    MongoDB Port 27017: Passwordless Access, NoSQL Injection, and Data Dumps

    MongoDB exposed on 27017? Login without authentication, bypass $ne login, dump credentials and MFA secret, and perform privilege escalation. Complete pentest with live payloads.

    Discover more Discover more
  • Webmin Port 10000: RCE Backdoor and Instant Root
    networking

    Webmin Port 10000: RCE Backdoor and Instant Root

    Port 10000 Webmin: CVE-2019-15107 pre-auth RCE root backdoor, CVE-2022-0824 file manager, CVE-2024-12828 CVSS 9.9, Metasploit modules, and post-exploitation with full root access.

    Discover more Discover more
  • Elasticsearch Port 9200: Dump Indexes, Credentials, and Groovy RCE
    networking

    Elasticsearch Port 9200: Dump Indexes, Credentials, and Groovy RCE

    Port 9200 Elasticsearch without authentication: Index dumps with credentials and PII, password lookup in logs, Groovy script RCE, CVE-2015-1427, elasticdump, and lateral movement from ELK stack.

    Discover more Discover more
  • Port 9000 Pentest: PHP-FPM RCE, SonarQube, and Portainer
    networking

    Port 9000 Pentest: PHP-FPM RCE, SonarQube, and Portainer

    Port 9000: Direct RCE via PHP-FPM FastCGI exposed, SonarQube admin:admin with hardcoded source code and credentials, Portainer without initial setup and container escape.

    Discover more Discover more
  • Port 9090 Pentest: Prometheus, Cockpit Linux and JBoss RCE
    networking

    Port 9090 Pentest: Prometheus, Cockpit Linux and JBoss RCE

    Port 9090: Authless Prometheus exposes entire infrastructure and credentials, Cockpit provides a Linux shell in the browser, and JBoss WAR deploys for RCE. Operational cheat sheet included.

    Discover more Discover more
  • Kafka Pentest Port 9092: Message Interception and Message Injection
    networking

    Kafka Pentest Port 9092: Message Interception and Message Injection

    Port 9092 Apache Kafka without authentication: topic list, real-time message interception, message injection, Kafka Connect credentials JDBC and full offensive chain.

    Discover more Discover more
  • Port 9300 Elasticsearch Transport: Cluster Join and Java RCE
    networking

    Port 9300 Elasticsearch Transport: Cluster Join and Java RCE

    Elasticsearch transport port 9300: Unauthorized cluster join, data replication to malicious node, Java deserialization RCE CVE-2015-5377, and operational differences from port 9200.

    Discover more Discover more
  • Port 9418 Git Daemon: Pentest, Clone Repository and Secret Extraction
    networking

    Port 9418 Git Daemon: Pentest, Clone Repository and Secret Extraction

    Port 9418: Authenticationless git daemon: Repository clone, credential extraction from commit history, truffleHog, gitleaks, web-exposed .git, and lateral movement from source code.

    Discover more Discover more
  • Port 9999 Pentest: Abyss, Icecast CVE-2004-1561, and Dev Server
    networking

    Port 9999 Pentest: Abyss, Icecast CVE-2004-1561, and Dev Server

    Port 9999: Abyss Web Server directory traversal and admin bypass, Icecast buffer overflow RCE CVE-2004-1561, Varnish admin exposed, unprotected server staging and backdoor detection.

    Discover more Discover more
  • Oracle EBS Pentest: Port 7777, OHS and CVE 2026
    networking

    Oracle EBS Pentest: Port 7777, OHS and CVE 2026

    Offensive guidance on Oracle HTTP Server port 7777: OHS enumeration, EBS and PeopleSoft default credentials, CVE-2022-21587, PL/SQL gateway injection, SSRF, and lateral movement.

    Discover more Discover more
  • Port 8000 Pentest: Django Debug, Python http.server and RCE
    networking

    Port 8000 Pentest: Django Debug, Python http.server and RCE

    Port 8000 offensive guide: Django DEBUG=True, Python http.server directory listing, Flask Werkzeug console, PHP built-in server and credential extraction. With cheat sheets.

    Discover more Discover more
  • HTTP-alt Port 8008: Grafana, Splunk, and Internal Pentest APIs
    networking

    HTTP-alt Port 8008: Grafana, Splunk, and Internal Pentest APIs

    Alternative HTTP port 8008: Grafana and Splunk default credentials, CVE-2021-43798 path traversalSpring Boot Actuator heapdump, internal REST APIs and credential extraction.

    Discover more Discover more
  • Port 8081 Pentest: Nexus Repository, Traefik and OWASP API
    networking

    Port 8081 Pentest: Nexus Repository, Traefik and OWASP API

    Port 8081: Nexus Repository default credentials, CVE-2019-7238 RCE, Traefik dashboard without auth, OWASP API Security Top 10 with operational payloads and supply chain attacks.

    Discover more Discover more
  • Port 8443 HTTPS Pentest: vCenter, pfSense, UniFi and CVE
    networking

    Port 8443 HTTPS Pentest: vCenter, pfSense, UniFi and CVE

    Alternative HTTPS port 8443: VMware vCenter CVE-2021-21972, pfSense RCE, UniFi Log4Shell, Cisco ASDM default credentials, certificate intelligence, and TLS hardening.

    Discover more Discover more
  • Port 8888 Jupyter Notebook: Direct RCE and Credential Extraction
    networking

    Port 8888 Jupyter Notebook: Direct RCE and Credential Extraction

    Port 8888 Authentication-free Jupyter Notebook: Direct code execution, token leak, integrated terminal, hardcoded credentials in notebooks, and real-world step-by-step attack chain.

    Discover more Discover more
  • Neo4j Pentest: Cypher Injection, APOC RCE and Port 7474
    networking

    Neo4j Pentest: Cypher Injection, APOC RCE and Port 7474

    Neo4j port 7474/7687 pentest: enumeration, default credentials, cypher injection, APOC RCE, hash dump, and API key. Complete guide 2026.

    Discover more Discover more
  • Port 7070 Pentest: RealServer, Helix and AnyDesk
    networking

    Port 7070 Pentest: RealServer, Helix and AnyDesk

    Port 7070 open? 2026 Pentest Guide: What is it, Helix/RealServer enumeration, RTSP exploits, directory traversal, AnyDesk, and Java app server.

    Discover more Discover more
  • Port 5601 Kibana: Dev Tools, Log Leak and Elasticsearch
    networking

    Port 5601 Kibana: Dev Tools, Log Leak and Elasticsearch

    Kibana Port 5601 in Pentest: Dev Tools Console, Elasticsearch Queries, Log Exposure, Internal Hosts, and Sensitive Credentials in Indexed Data

    Discover more Discover more
  • VNC Port 5900: No Auth, Brute Force, and Remote Desktop
    networking

    VNC Port 5900: No Auth, Brute Force, and Remote Desktop

    Port 5900 VNC in the pentest: remote desktop access, unauthenticated instances, password brute force, screenshots, and session hijacking.

    Discover more Discover more
  • Port 5986 WinRM HTTPS: Certificates, ADCS, and Evil-WinRM
    networking

    Port 5986 WinRM HTTPS: Certificates, ADCS, and Evil-WinRM

    WinRM HTTPS port 5986 in the pentest: client certificates, Evil-WinRM over TLS, ADCS abuse, and remote access via certificate-based authentication.

    Discover more Discover more
  • Port 6000 X11: Screenshots, Keylogging and Desktop Hijack
    networking

    Port 6000 X11: Screenshots, Keylogging and Desktop Hijack

    Port 6000 X11 in the pentest: exposed remote display, desktop screenshots, keylogging, input injection and session hijacking on Linux and Unix systems.

    Discover more Discover more
  • Port 6379 Redis: No Auth, RCE and Credential Dump
    networking

    Port 6379 Redis: No Auth, RCE and Credential Dump

    Redis port 6379 in pentest: unauthenticated login, key and session dumps, SSH key injection, malicious modules, and RCE.

    Discover more Discover more
  • Port 6443 Kubernetes API: Tokens, Secrets, and Cluster Admin
    networking

    Port 6443 Kubernetes API: Tokens, Secrets, and Cluster Admin

    Port 6443 Kubernetes APIs in the pentest: ServiceAccount token, secret extraction, pod access, escalation to cluster-admin, and cluster compromise.

    Discover more Discover more
  • Port 6667 IRC: UnrealIRCd, C2 and Information Gathering
    networking

    Port 6667 IRC: UnrealIRCd, C2 and Information Gathering

    IRC port 6667 in the pentest: server and channel enumeration, user and hostname info leak, C2 botnet, UnrealIRCd, and hijacking risks.

    Discover more Discover more
  • WebLogic Port 7001: T3, Admin Console, and RCE
    networking

    WebLogic Port 7001: T3, Admin Console, and RCE

    WebLogic port 7001 in pentest: T3 protocol, admin console, CVE RCE pre-auth, SSRF, and Oracle WebLogic Server access exposed.

    Discover more Discover more
  • WebLogic SSL port 7002: HTTPS, T3S and RCE
    networking

    WebLogic SSL port 7002: HTTPS, T3S and RCE

    WebLogic SSL Port 7002 in Pentest: HTTPS Console, T3S, TLS Certificates, Pre-Auth CVEs, and Attacks on Encrypted Oracle WebLogic Server.

    Discover more Discover more
  • SVN Port 3690: Exposed Repositories and Secret Leakage
    networking

    SVN Port 3690: Exposed Repositories and Secret Leakage

    Bring 3690 SVN to the pentest: exposed repositories, anonymous checkout, commit history, source code disclosure, and recoverable credentials.

    Discover more Discover more
  • Spark UI Port 4040: Pentest, Credentials, and Cluster Map
    networking

    Spark UI Port 4040: Pentest, Credentials, and Cluster Map

    Bring 4040 Spark UI to pentest: environment leak, worker discovery, exposed credentials, and pivot to 6066 REST API and big data cluster.

    Discover more Discover more
  • Port 4500 IPsec NAT-T: VPN, IKE and PSK Cracking
    networking

    Port 4500 IPsec NAT-T: VPN, IKE and PSK Cracking

    Port 4500 IPsec NAT-T in the pentest: IKE, NAT traversal, aggressive mode, PSK cracking and exposed VPN surface analysis.

    Discover more Discover more
  • Port 5000 Docker Registry and Flask: Debug, RCE and Secret Leak
    networking

    Port 5000 Docker Registry and Flask: Debug, RCE and Secret Leak

    Port 5000 in pentest: Docker Registry exposed with downloadable images and secrets, or Flask debug with console tool and RCE from the browser.

    Discover more Discover more
  • Port 5672 RabbitMQ: AMQP, Code and Management API
    networking

    Port 5672 RabbitMQ: AMQP, Code and Management API

    RabbitMQ port 5672 to the pentest: AMQP queues and messages, exposed credentials, Management API 15672, injection and Erlang cookie risk.

    Discover more Discover more
  • Port 2082 cPanel: Pentest, Credential Reuse and Webshell
    networking

    Port 2082 cPanel: Pentest, Credential Reuse and Webshell

    Port 2082 cPanel in the pentest: unencrypted HTTP login, credential reuse, upload via File Manager, database access, email, and backups.

    Discover more Discover more
  • Port 2083 cPanel SSL: Pentest, API and HTTPS Login
    networking

    Port 2083 cPanel SSL: Pentest, API and HTTPS Login

    Port 2083 cPanel SSL in pentest: HTTPS login, TLS enumeration, cPanel API, file upload, post-auth automation, and cPHulk checks.

    Discover more Discover more
  • Port 2181 ZooKeeper: Pentest, Dump, and Four-Letter Commands
    networking

    Port 2181 ZooKeeper: Pentest, Dump, and Four-Letter Commands

    Port 2181 ZooKeeper into the pentest: four-letter commands, dump configurations, cluster enumeration, and sensitive metadata.

    Discover more Discover more
  • Port 2376 Docker TLS API: Pentest and mTLS
    networking

    Port 2376 Docker TLS API: Pentest and mTLS

    Port 2376 Docker TLS API in pentest: TLS enumeration, mutual TLS, client certificate theft, misconfigurations, and remote daemon access

    Discover more Discover more
  • Port 2483 Oracle DB: TNS Listener, SID and Pentest
    networking

    Port 2483 Oracle DB: TNS Listener, SID and Pentest

    Oracle DB Port 2483 in Pentest: TNS Listener, SID and Service Name Enumeration, Credential Brute Force, DBA Escalation, and System Access Techniques

    Discover more Discover more
  • Port 2484 Oracle TCPS: Wallet, TLS and Pentest
    networking

    Port 2484 Oracle TCPS: Wallet, TLS and Pentest

    Oracle TCPS port 2484 in pentest: Encrypted TNS Listener, certificates and Oracle Wallet, TLS enumeration and differences with 2483.

    Discover more Discover more
  • Port 2701 TVersity: Web UI and Information Disclosure
    networking

    Port 2701 TVersity: Web UI and Information Disclosure

    Port 2701 TVersity in the pentest: media server with exposed web UI, shared file disclosure and access surface analysis.

    Discover more Discover more
  • 3260 iSCSI port: Pentest, Target, LUN and CHAP
    networking

    3260 iSCSI port: Pentest, Target, LUN and CHAP

    Bringing the 3260 iSCSI to the pentest: target and LUN discovery, storage volume access, CHAP, remote disk mounts, and exposed data analysis.

    Discover more Discover more
  • Port 3478 STUN/TURN: NAT Traversal, Relay Abuse, and Pentest
    networking

    Port 3478 STUN/TURN: NAT Traversal, Relay Abuse, and Pentest

    Port 3478 STUN/TURN in pentest: NAT traversal, IP leak, NAT type, TURN relay abuse and misconfigurations in WebRTC and VoIP infrastructures.

    Discover more Discover more
  • Port 3632 DistCC: Direct RCE and CVE-2004-2687
    networking

    Port 3632 DistCC: Direct RCE and CVE-2004-2687

    DistCC Port 3632 in Pentest: distccd exposed, RCE without authentication via CVE-2004-2687, Nmap NSE verification, and immediate impact

    Discover more Discover more
  • Port 1991 cPanel and WHM: Pentesting, Enumeration, and Hardening
    networking

    Port 1991 cPanel and WHM: Pentesting, Enumeration, and Hardening

    cPanel and WHM Pentest Guide: 2083, 2087, and Webmail 2096 Panels, Account Enumeration, APIs, Hosting Exposure, and Critical Misconfigurations

    Discover more Discover more
  • Port 1434 MSSQL: SQL Server Browser and Instance Discovery
    networking

    Port 1434 MSSQL: SQL Server Browser and Instance Discovery

    MSSQL Pentest on port 1434/UDP: SQL Server Browser enumeration, named instance, version, dynamic ports, and SQL instance discovery in lab.

    Discover more Discover more
  • Citrix ICA Port 1604: ICA Browser, Published Apps, and StoreFront
    networking

    Citrix ICA Port 1604: ICA Browser, Published Apps, and StoreFront

    Citrix Pentest on port 1604/UDP: ICA Browser enumeration, published apps, StoreFront, 1494/2598 services, and access to Citrix Virtual Apps environments in lab.

    Discover more Discover more
  • PPTP Port 1723: MS-CHAPv2 and VPN Credentials
    networking

    PPTP Port 1723: MS-CHAPv2 and VPN Credentials

    PPTP Pentest on Port 1723: What it is, Control Channel Fingerprinting, MS-CHAPv2 Analysis, Legacy VPN Credentials, GRE, and Internal Network Access Risk.

    Discover more Discover more
  • RADIUS Port 1812: Shared Secret, EAP, and Network Access
    networking

    RADIUS Port 1812: Shared Secret, EAP, and Network Access

    RADIUS Pentest on Port 1812/UDP: Test Shared Secret, EAP Authentication, AD/LDAP Backend, RADIUS Accounting, and Network Access Control in the Lab.

    Discover more Discover more
  • Port 1813 RADIUS Accounting: Sessions, Assigned IPs, and RADIUS 1812
    networking

    Port 1813 RADIUS Accounting: Sessions, Assigned IPs, and RADIUS 1812

    Pentest RADIUS Accounting on port 1813/UDP: session tracking, Framed-IP, Accounting-Request, correlation with 1812 and visibility into network sessions in the lab.

    Discover more Discover more
  • Port 1883 MQTT: Pentest, Topic Enumeration and Injection
    networking

    Port 1883 MQTT: Pentest, Topic Enumeration and Injection

    Port 1883 MQTT in IoT pentest: topic enumeration, anonymous subscription, message injection, and clear text credentials on exposed brokers.

    Discover more Discover more
  • SSDP/UPnP Port 1900: Pentest, Port Mapping, and SSRF
    networking

    SSDP/UPnP Port 1900: Pentest, Port Mapping, and SSRF

    Port 1900 SSDP/UPnP in pentest: device discovery, port mapping abuse, SSRF via CallStranger, and exposed services analysis.

    Discover more Discover more
  • HASP Port 1947: Pentest and Sentinel Admin Control Center
    networking

    HASP Port 1947: Pentest and Sentinel Admin Control Center

    Port 1947 HASP in the pentest: Sentinel Admin Control Center, dongle enumeration and active licenses, version check and License Manager RCE risks.

    Discover more Discover more
  • Port 1984 Xymon/BigBrother: Recon and Info Disclosure
    networking

    Port 1984 Xymon/BigBrother: Recon and Info Disclosure

    Brings 1984 Xymon and BigBrother to the pentest: agent monitoring, host data disclosure, exposed services, and infrastructure dashboard accessible without adequate controls.

    Discover more Discover more
  • UPnP Port 1990: SOAP, Port Mapping and Device Control
    networking

    UPnP Port 1990: SOAP, Port Mapping and Device Control

    Port 1990 UPnP in the pentest: SOAP action, port mapping abuse, device control and analysis of IGD services exposed on the router.

    Discover more Discover more
  • SNMP Port 1993: Inform, Trap and Monitoring
    networking

    SNMP Port 1993: Inform, Trap and Monitoring

    Bring 1993 SNMP into the pentest: SNMP Inform, trap correlation, community string, alternative collectors and information disclosure on monitoring servers.

    Discover more Discover more
  • NFS port 2049: Pentest, no_root_squash, and Lateral Movement
    networking

    NFS port 2049: Pentest, no_root_squash, and Lateral Movement

    Port 2049 NFS in the pentest: export enumeration, remote mount, UID spoofing, no_root_squash, SSH key injection, and privesc Linux.

    Discover more Discover more
  • PostgreSQL port 5432: Payload, pg_shadow, COPY PROGRAM and RCE
    networking

    PostgreSQL port 5432: Payload, pg_shadow, COPY PROGRAM and RCE

    PostgreSQL pentest on port 5432: enumeration, brute force, pg_shadow, file read/write, COPY PROGRAM, RCE and privilege escalation in lab.

    Discover more Discover more
  • POP3 Port 110: Brute Force, Credential Sniffing, and Mailbox Access
    networking

    POP3 Port 110: Brute Force, Credential Sniffing, and Mailbox Access

    Port 110 exposes POP3, the protocol used to download email from the server to the client. A practical guide to enumeration, brute force, cleartext credential sniffing, message downloading, and mail server hardening.

    Discover more Discover more
  • OpenVPN Port 1194: .ovpn Files, VPN Credentials, and Internal Access
    networking

    OpenVPN Port 1194: .ovpn Files, VPN Credentials, and Internal Access

    OpenVPN pentest on port 1194: UDP/TCP fingerprinting, .ovpn file analysis, credential testing, client certificates, and internal network access in the lab.

    Discover more Discover more
  • Port 1352 Lotus Notes/Domino: NRPC, names.nsf and WebAdmin
    networking

    Port 1352 Lotus Notes/Domino: NRPC, names.nsf and WebAdmin

    Lotus Notes/Domino pentest on port 1352: NRPC enums, names.nsf, Domino Directory, NSF databases, WebAdmin, and weak logins in legacy environments.

    Discover more Discover more
  • IMAP Port 143: Mailbox Access, Brute Force, and Mail Server Enumeration
    networking

    IMAP Port 143: Mailbox Access, Brute Force, and Mail Server Enumeration

    Port 143 exposes IMAP, the protocol used to access and synchronize email and folders directly on the server. A practical guide to enumeration, login testing, mailbox discovery, and mail server hardening.

    Discover more Discover more
  • Port 1521 Oracle DB: TNS Listener, SID and Privilege Escalation
    networking

    Port 1521 Oracle DB: TNS Listener, SID and Privilege Escalation

    Oracle Pentest 1521: TNS Listener enumeration, payload, SID, and service name, weak credential testing, SQL injection, escalation to DBA, and lateral movement in the lab.

    Discover more Discover more
  • SMTP Port 25: User Enumeration, Open Relay, and SMTP AUTH
    networking

    SMTP Port 25: User Enumeration, Open Relay, and SMTP AUTH

    SMTP port 25 can expose user enumeration via VRFY and RCPT TO, open relay, email spoofing, and brute force on SMTP AUTH. A practical guide to mail server enumeration, exploits, detection, and hardening.

    Discover more Discover more
  • Port 43 WHOIS: OSINT on Domains, IPs and Name Servers
    networking

    Port 43 WHOIS: OSINT on Domains, IPs and Name Servers

    WHOIS port 43 allows passive queries on domains, IPs, and ASNs to gather registrars, name servers, contacts, and expiration dates for reconnaissance and OSINT.

    Discover more Discover more
  • Port 5000: Docker Registry, Flask Debug, and UPnP
    networking

    Port 5000: Docker Registry, Flask Debug, and UPnP

    Bring 5000 into the pentest: recognize Docker Registry, Flask debug, UPnP or Synology DSM. Enumeration, image pull, RCE Werkzeug and SOAP abuse in lab.

    Discover more Discover more
  • Port 1026 MS RPC: Windows dynamic endpoints, port 135 and remoting.
    networking

    Port 1026 MS RPC: Windows dynamic endpoints, port 135 and remoting.

    Learn what port 1026 is in MS RPC, why it correlates with the endpoint mapper on 135, and how dynamic RPC ports change between legacy and modern Windows systems, impacting enumeration, firewalling, and lateral movement.

    Discover more Discover more
  • TCP Port 1080: SOCKS Proxy and Pivoting in the Internal Network
    networking

    TCP Port 1080: SOCKS Proxy and Pivoting in the Internal Network

    Port 1080 can expose an open SOCKS proxy that can be used for pivoting, tunneling, and internal network access. Learn how to identify, test, and exploit it in authorized pentests.

    Discover more Discover more
  • Port 21 FTP: Anonymous Login, Brute Force and Exploits
    networking

    Port 21 FTP: Anonymous Login, Brute Force and Exploits

    FTP port 21 remains a key pentest target: discover enumeration, anonymous login, brute force, file uploads, vsftpd and ProFTPD exploits, detection, and practical hardening.

    Discover more Discover more
  • Telnet Port 23: Clear Text Credentials, Sniffing, and Brute Force
    networking

    Telnet Port 23: Clear Text Credentials, Sniffing, and Brute Force

    Telnet port 23 is an immediate critical finding: it transmits credentials in clear text, facilitating brute force, sniffing, and insecure remote access. Learn how to enumerate, attack, and secure it.

    Discover more Discover more
  • Port 1025 MS RPC: Windows dynamic endpoints, port 135 and lateral movement.
    networking

    Port 1025 MS RPC: Windows dynamic endpoints, port 135 and lateral movement.

    Learn what port 1025 is in MS RPC, why it correlates with the endpoint mapper on 135, and how dynamic RPC ports depend on the Windows version: 1025-5000 on legacy systems, 49152-65535 from Windows Vista/Server 2008 onwards.

    Discover more Discover more
  • Port 912 Apex Mesh / MeshCentral: RMM servers, remote agents, and centralized compromise.
    networking

    Port 912 Apex Mesh / MeshCentral: RMM servers, remote agents, and centralized compromise.

    Learn what port 912 is associated with apex-mesh and why it might indicate a remote management platform like MeshCentral: centralized access to endpoints, remote agents, and high-impact surface area for the entire managed network.

    Discover more Discover more
  • Port 990 FTPS: Anonymous login, brute force, and file exfiltration over encrypted FTP.
    networking

    Port 990 FTPS: Anonymous login, brute force, and file exfiltration over encrypted FTP.

    Learn what port 990 ftps is, how it relates to port 989 ftps-data, and why anonymous logins, weak credentials, and exposed backups remain the primary risks of TLS-protected file transfers.

    Discover more Discover more
  • POP3S Port 995: Brute force, mailbox dump, and credential reuse on encrypted emails.
    networking

    POP3S Port 995: Brute force, mailbox dump, and credential reuse on encrypted emails.

    Learn what POP3S port 995 is, why POP3 over TLS uses implicit encryption on the email channel, and how weak credentials, mailbox access, and sensitive content still make POP3S a relevant target.

    Discover more Discover more
  • Port 880 Kerberos Admin: KDC kadmin, kpasswd and password policy.
    networking

    Port 880 Kerberos Admin: KDC kadmin, kpasswd and password policy.

    Learn what port 880 is associated with legacy or custom Kerberos admin services, how it relates to kadmin and kpasswd, and why password policies, principals, and KDC configuration are valuable for Kerberos enumeration.

    Discover more Discover more
  • Port 902 VMware ESXi: vCenter, vmware-authd, and hypervisor risk.
    networking

    Port 902 VMware ESXi: vCenter, vmware-authd, and hypervisor risk.

    Learn what VMware port 902 is, used in core communications between vCenter Server and ESXi, and why identifying a host with vmware-authd is a high-impact surface for your entire virtual infrastructure.

    Discover more Discover more
  • Port 989 FTPS-Data: Encrypted data channel, implicit TLS and file transfer security.
    networking

    Port 989 FTPS-Data: Encrypted data channel, implicit TLS and file transfer security.

    Learn what ftps-data port 989 is, how it relates to port 990 in implicit FTPS, and why certificates, TLS, and access permissions remain crucial to evaluating file transfer security.

    Discover more Discover more
  • LDAPS port 636: Active Directory enumeration, TLS certificates, and AD CS abuse.
    networking

    LDAPS port 636: Active Directory enumeration, TLS certificates, and AD CS abuse.

    Learn what LDAPS port 636 is, how LDAP over SSL can reveal your hostname, domain, and enterprise CA, and why LDAP signing and channel binding remain crucial for reducing Active Directory relay and exposure.

    Discover more Discover more
  • Port 513 Rlogin: .rhosts trust, root access and legacy Unix lateral movement
    networking

    Port 513 Rlogin: .rhosts trust, root access and legacy Unix lateral movement

    Learn what Rlogin port 513 is, how .rhosts and hosts.equiv work, why trust can open passwordless logins, and how to identify trust chains and lateral movement on legacy Unix systems.

    Discover more Discover more
  • Port 554 RTSP: default credentials, vendor path, and IP camera video feeds.
    networking

    Port 554 RTSP: default credentials, vendor path, and IP camera video feeds.

    Learn what RTSP port 554 is, how to detect paths from Hikvision, Dahua, and other vendors, and why CCTV, DVR, and NVR streams with weak or no authentication pose a real risk to video surveillance.

    Discover more Discover more
  • Port 587 SMTP Submission: user enumeration, STARTTLS and email credentials.
    networking

    Port 587 SMTP Submission: user enumeration, STARTTLS and email credentials.

    Find out what SMTP Submission port 587 is, how authenticated email sending works according to RFC 6409, and why STARTTLS and SMTP AUTH are crucial for evaluating the security of your email service.

    Discover more Discover more
  • Port 593 RPC over HTTP: IOXIDResolver, endpoint enumeration and DCOM stealth.
    networking

    Port 593 RPC over HTTP: IOXIDResolver, endpoint enumeration and DCOM stealth.

    Learn what http-rpc-epmap port 593 is, how ncacn_http works in a Microsoft environment, and why RPC over HTTP can expose endpoints, DCOM services, and useful information about the enterprise RPC surface.

    Discover more Discover more
  • IPMI port 623: RAKP hash disclosure, cipher 0 and out-of-band BMC risk.
    networking

    IPMI port 623: RAKP hash disclosure, cipher 0 and out-of-band BMC risk.

    Learn what port 623/UDP asf-rmcp is, how IPMI 2.0 works with RAKP, and why CVE-2013-4786 allows hash recovery from BMC responses, while cipher suite 0 support can drastically reduce remote management security.

    Discover more Discover more
  • Port 631 IPP/CUPS: RCE chain, cups-browsed and Linux print server compromise.
    networking

    Port 631 IPP/CUPS: RCE chain, cups-browsed and Linux print server compromise.

    Learn what IPP/CUPS port 631 is, how the Internet Printing Protocol over TCP and UDP 631 works, and why the 2024 cups-browsed vulnerability chain brought RCE, printer discovery, and Linux print server security back to the forefront.

    Discover more Discover more
  • HTTPS Port 443: What It Is, How It Works, and the Security Risks of TLS and Web Apps
    networking

    HTTPS Port 443: What It Is, How It Works, and the Security Risks of TLS and Web Apps

    Learn what HTTPS port 443 is for, how TLS, certificates, and virtual hosts work, and the risks it introduces, including exposed hostnames in SANs, TLS misconfigurations, sensitive files, admin panels, and web attack surfaces.

    Discover more Discover more
  • SMTPS Port 465: What it is, how it works, and the security risks of TLS mail submission.
    networking

    SMTPS Port 465: What it is, how it works, and the security risks of TLS mail submission.

    Learn what SMTPS port 465 is used for, how SMTP Submission over TLS works, and what risks it introduces, including user enumeration, open relay, brute force SMTP AUTH, and internal phishing with valid credentials.

    Discover more Discover more
  • ISAKMP Port 500: IPsec VPN, IKEv1 Aggressive Mode and PSK Crack
    networking

    ISAKMP Port 500: IPsec VPN, IKEv1 Aggressive Mode and PSK Crack

    ISAKMP port 500 in pentest: IPsec VPN enumeration, IKE fingerprinting, Aggressive Mode, PSK hash extraction, offline cracking, and tunneling to internal network.

    Discover more Discover more
  • Rexec Port 512: What It Is, Vulnerability, and a Complete Pentest Guide
    networking

    Rexec Port 512: What It Is, Vulnerability, and a Complete Pentest Guide

    Rexec Port 512: What it is, how it works, and how to test it in a pentest. Enumeration, cleartext credential sniffing, credential spraying, command execution, and risks of legacy Unix systems.

    Discover more Discover more
  • Syslog Port 514: Cleartext Logs, Syslog Injection, and UDP Collector Risk
    networking

    Syslog Port 514: Cleartext Logs, Syslog Injection, and UDP Collector Risk

    Learn what syslog port 514/UDP is, how to identify collectors and logging streams, what data can travel in the clear, and why syslog over TLS on 6514 reduces eavesdropping and spoofing.

    Discover more Discover more
  • LPD Port 515: File read, queue enumeration, and legacy print server risks
    networking

    LPD Port 515: File read, queue enumeration, and legacy print server risks

    Learn what LPD port 515 is, how the Line Printer Daemon defined in RFC 1179 works, and why print queues, Unix/Linux print servers, and legacy services can expose sensitive information and overlooked attack surfaces.

    Discover more Discover more
  • RIP Port 520: Route Sniffing, Route Injection, and MitM Risk on Legacy Networks
    networking

    RIP Port 520: Route Sniffing, Route Injection, and MitM Risk on Legacy Networks

    Learn what port 520/UDP used by RIP is, how RIPv1 and RIPv2 work, and why route advertisements can expose network topology and increase the risk of route poisoning, traffic redirection, and path manipulation.

    Discover more Discover more
  • IRC Port 194: What It Is, How It Works, and Differences Between Ports 6667 and 6697
    networking

    IRC Port 194: What It Is, How It Works, and Differences Between Ports 6667 and 6697

    Learn what IRC port 194 is for, why many servers use 6667 or 6697, how the protocol works, and the risks it introduces, including user enumeration, channels, internal hostname leaks, and vulnerable daemons.

    Discover more Discover more
  • SMUX Port 199: What It Is, How It Works, and SNMP Security Risks
    networking

    SMUX Port 199: What It Is, How It Works, and SNMP Security Risks

    Learn what SMUX port 199 does, how it connects SNMP subagents and master agents, what risks it introduces when exposed to the network, and how to analyze registrations, OIDs, and misconfigurations in legacy systems.

    Discover more Discover more
  • FTP Ports 20 and 21: What the Protocol Is, How It Works, and Where It Actually Attacks
    networking

    FTP Ports 20 and 21: What the Protocol Is, How It Works, and Where It Actually Attacks

    A practical guide to FTP (File Transfer Protocol) ports 20 and 21: the difference between control and data channels, active/passive mode, sniffing risks, FTP bounces, and common vulnerabilities in legacy servers and labs.

    Discover more Discover more
  • Port 162 SNMP Trap: What It Is, How It Works, and How It Differs from Port 161
    networking

    Port 162 SNMP Trap: What It Is, How It Works, and How It Differs from Port 161

    Learn what the SNMP Trap port 162 is used for, how the notification channel works compared to port 161, what risks it introduces with SNMPv1/v2c, and how to exploit it for reconnaissance, sniffing, and passive intelligence gathering.

    Discover more Discover more
  • BGP Port 179: What It Is, How It Works, and Routing Security Risks
    networking

    BGP Port 179: What It Is, How It Works, and Routing Security Risks

    Learn what BGP port 179 is used for, how Autonomous System peering works, what risks a misconfigured session introduces, and how to analyze enumeration, route injection, and hijacking in an authorized pentest/CTF.

    Discover more Discover more
  • Squid Proxy Port 3128: What It Is, How It Works, and Security Risks
    networking

    Squid Proxy Port 3128: What It Is, How It Works, and Security Risks

    Learn what Squid port 3128 is used for, how an HTTP/HTTPS forward proxy works, the risks a misconfigured open proxy introduces, and how to exploit or defend against it in pivoting, access to internal services, and ACL control.

    Discover more Discover more
  • RDP Port 3389: What is Remote Desktop, How it Works, and Security Risks
    networking

    RDP Port 3389: What is Remote Desktop, How it Works, and Security Risks

    Learn what RDP port 3389 is used for, how Remote Desktop, NLA, and CredSSP work, what risks service exposure introduces, and how to attack or defend against brute force, BlueKeep, and lateral movement.

    Discover more Discover more
  • Network Sniffing: How to Capture Traffic, Credentials, and Packet Data in Pentests
    networking

    Network Sniffing: How to Capture Traffic, Credentials, and Packet Data in Pentests

    Network Sniffing: How to Capture Traffic, Credentials, and Packet Data in Pentests

    Discover more Discover more
  • VPN: Protocols, Security, and Vulnerabilities (WireGuard, OpenVPN, IPSec)
    networking

    VPN: Protocols, Security, and Vulnerabilities (WireGuard, OpenVPN, IPSec)

    How VPNs work and what they are at a technical level: IPSec, OpenVPN, WireGuard, L2TP, and PPTP. Tunnel architecture, real-world attacks, misconfigurations, and pentest analysis.

    Discover more Discover more
  • Blind XSS: What It Is and How to Detect It with Out-of-Band Callbacks and XSS Hunter
    networking

    Blind XSS: What It Is and How to Detect It with Out-of-Band Callbacks and XSS Hunter

    Complete guide to Blind XSS: out-of-band detection, server callbacks, XSS Hunter, stealth payloads, admin injection points, and internal panel trigger analysis.

    Discover more Discover more
  • STP and RSTP Under Attack: Root Bridge, BPDUs, and Network Takeover
    networking

    STP and RSTP Under Attack: Root Bridge, BPDUs, and Network Takeover

    Learn how STP and RSTP work, what the Root Bridge, Spanning Tree Protocol, and how BPDU election occurs, and what real risks exist in pentesting: takeover, TCN floods, and layer 2 attacks.

    Discover more Discover more
  • TCP (Transmission Control Protocol): What it is, how it works, and how to use it in a pentest
    networking

    TCP (Transmission Control Protocol): What it is, how it works, and how to use it in a pentest

    Complete guide to TCP: three-way handshake, flags, sequence number, windowing, port scanning with Nmap, session hijacking, SYN flood and traffic analysis.

    Discover more Discover more
  • TLS/SSL Pentesting: Handshake, Cipher Suite and Vulnerabilities
    networking

    TLS/SSL Pentesting: Handshake, Cipher Suite and Vulnerabilities

    TLS/SSL Pentesting Guide 2026: Handshakes, Weak Cipher Suites, ECH, Post-Quantum, Heartbleed, POODLE, and 15+ Vulnerabilities to Test with testssl.sh.

    Discover more Discover more
  • VLANs and 802.1Q: Network Segmentation, Trunks, and VLAN Hopping in a Pentest
    networking

    VLANs and 802.1Q: Network Segmentation, Trunks, and VLAN Hopping in a Pentest

    Learn how VLANs and 802.1Q work, the difference between access and trunk, native VLANs, inter-VLAN routing, DTP, double tagging, and VLAN hopping techniques in pentests.

    Discover more Discover more
  • VRRP, HSRP and CARP: gateway takeover, failover and MITM attacks
    networking

    VRRP, HSRP and CARP: gateway takeover, failover and MITM attacks

    Learn how VRRP, HSRP, and CARP work, how gateway failover occurs, and why takeover, priority abuse, and MITM are real risks in network pentesting.

    Discover more Discover more
  • Wi-Fi 802.11: Frame, WPA2/WPA3, Deauth, and the Evil Twin — The Complete Guide to Wireless Attacks
    networking

    Wi-Fi 802.11: Frame, WPA2/WPA3, Deauth, and the Evil Twin — The Complete Guide to Wireless Attacks

    The Complete Guide to 802.11 Wi-Fi: Wireless Frames, Monitor Mode, WPA2/WPA3, Four-Way Handshake, PMKID, Deauthentication, Evil Twin, and Real-World Pentesting Risks.

    Discover more Discover more
  • PPP, PPPoE, and PPTP: A Guide to Real-World Risks for Pentesters
    networking

    PPP, PPPoE, and PPTP: A Guide to Real-World Risks for Pentesters

    PPP Explained Well: How the Point-to-Point Protocol Works, the Differences Between PAP and CHAP, PPPoE, PPTP, MS-CHAPv2, Real-World Attacks, and Their Impact on Modern Pentesting.

    Discover more Discover more
  • QUIC What is HTTP/3, 0-RTT and blind spot in pentesting
    networking

    QUIC What is HTTP/3, 0-RTT and blind spot in pentesting

    QUIC explained clearly: what it is, how it works with HTTP/3, 0-RTT risks, UDP 443 inspection gap, logging bypass, and real-world implications for pentesting.

    Discover more Discover more
  • SCTP in the telco pentest: multi-streaming, multi-homing, and attack surfaces
    networking

    SCTP in the telco pentest: multi-streaming, multi-homing, and attack surfaces

    SCTP What is it: how it works, four-way handshake, multi-streaming, multi-homing, scanning with Nmap, risks on SIGTRAN, Diameter and 4G/5G networks.

    Discover more Discover more
  • SNMP and Community Strings: How to Read Half the Network in a Pentest
    networking

    SNMP and Community Strings: How to Read Half the Network in a Pentest

    SNMP: what it is, how it works, OID, public/private community string, snmpwalk, brute force, write access, and real risks in an enterprise pentest.

    Discover more Discover more
  • UDP (User Datagram Protocol): What it is, how it works, and how to exploit it in a pentest.
    networking

    UDP (User Datagram Protocol): What it is, how it works, and how to exploit it in a pentest.

    UDP explained clearly: headers, differences with TCP, UDP scanning with Nmap, critical services like DNS, SNMP and NTP, amplification attacks and real risks in pentesting.

    Discover more Discover more
  • GRE (Generic Routing Encapsulation): What it is, how it works, and how to use it in pentesting
    networking

    GRE (Generic Routing Encapsulation): What it is, how it works, and how to use it in pentesting

    Learn what GRE is, how Generic Routing Encapsulation tunneling works, why it's risky in enterprise environments, and how to exploit or defend against it in a pentest.

    Discover more Discover more
  • IPSec: Enterprise VPN, IKE, ESP, and Misconfigurations to Exploit
    networking

    IPSec: Enterprise VPN, IKE, ESP, and Misconfigurations to Exploit

    Learn how IPSec works and why it is crucial in enterprise VPN pentesting: IKEv1/IKEv2, ESP, tunnel mode, aggressive mode, weak PSK, ike-scan, and defenses.

    Discover more Discover more
  • IPv4 vs. IPv6: Differences, Security, and Attacks in Network Pentesting
    networking

    IPv4 vs. IPv6: Differences, Security, and Attacks in Network Pentesting

    Learn the differences between IPv4 and IPv6 and why they matter in pentesting: SLAAC, NDP, RA spoofing, IPv6 scanning, dual-stack, control bypass, and defenses.

    Discover more Discover more
  • LLDP: The Protocol That Reveals Switches, VLANs, and Network Topology
    networking

    LLDP: The Protocol That Reveals Switches, VLANs, and Network Topology

    Learn what LLDP is, how it works, and why it's useful in pentesting: passive discovery, neighbor tables, VLANs, IP management, LLDP-MED, spoofing, and defenses.

    Discover more Discover more
  • NTP: How It Works, How to Exploit It, and Why It Can Take Down an Entire Network
    networking

    NTP: How It Works, How to Exploit It, and Why It Can Take Down an Entire Network

    Learn what NTP is, how it works, and why it's critical in pentesting: monlists, DDoS amplification, rogue NTP servers, time skew, Kerberos, TLS, logs, and defenses.

    Discover more Discover more
  • OSPF, EIGRP, BGP, and RIP: How They Work and How to Use Them in Pentests
    networking

    OSPF, EIGRP, BGP, and RIP: How They Work and How to Use Them in Pentests

    A complete guide to OSPF, EIGRP, BGP, and RIP: how they work, their differences, route injection, BGP hijacking, fake LSAs, MITMs, and defenses for dynamic routing protocols.

    Discover more Discover more
  • Ethernet (IEEE 802.3): What It Is, How It Works, and How to Use It in a Pentest
    networking

    Ethernet (IEEE 802.3): What It Is, How It Works, and How to Use It in a Pentest

    Learn what Ethernet is, how an 802.3 frame works, and why it's essential in pentesting: MAC address, switches, CAM table overflow, sniffing, spoofing, and defenses.

    Discover more Discover more
  • HTTP and HTTPS: What They Are, How They Work, and How to Use Them in a Pentest
    networking

    HTTP and HTTPS: What They Are, How They Work, and How to Use Them in a Pentest

    Learn what HTTP is, how HTTPS works, and why it's essential in web pentesting: methods, headers, cookies, status codes, fingerprinting, enumeration, and real-world attacks.

    Discover more Discover more
  • ICMP: What It Is, How It Works, and How to Use It in a Pentest
    networking

    ICMP: What It Is, How It Works, and How to Use It in a Pentest

    Learn what ICMP is, how ping and traceroute work, and why it's crucial in pentesting: host discovery, ICMP tunneling, redirection, fingerprinting, detection, and defenses.

    Discover more Discover more
  • IGMP (Multicast): What It Is, How It Works, and Why It Matters in Network Pentesting
    networking

    IGMP (Multicast): What It Is, How It Works, and Why It Matters in Network Pentesting

    Learn what IGMP is, how multicast works, and why it's useful in pentesting: host discovery, membership reporting, IGMP snooping, reconnaissance, DoS, and security.

    Discover more Discover more
  • IP (Internet Protocol): What It Is, How It Works, and Why It Matters in Pentesting
    networking

    IP (Internet Protocol): What It Is, How It Works, and Why It Matters in Pentesting

    Learn what IP is, how headers, TTLs, routing, and fragmentation work, and why it's essential in pentesting: IP spoofing, evasion, reconnaissance, and defenses.

    Discover more Discover more
  • ARP (Address Resolution Protocol): What It Is, How It Works, and How to Use It in a Pentest
    networking

    ARP (Address Resolution Protocol): What It Is, How It Works, and How to Use It in a Pentest

    Learn what ARP is, how it actually works, and how it's exploited in pentesting: ARP cache, gratuitous ARP, spoofing, MITM, detection, defenses, and practical tools.

    Discover more Discover more
  • DHCP: What It Is, How It Works, and How to Use It in a Pentest
    networking

    DHCP: What It Is, How It Works, and How to Use It in a Pentest

    Learn what DHCP is, how the DORA process works, and how to exploit it in a pentest: starvation, rogue DHCP servers, WPAD injection, option 121, and real-world defenses.

    Discover more Discover more
  • DNS: What It Is, How It Works, and How to Use It in a Pentest
    networking

    DNS: What It Is, How It Works, and How to Use It in a Pentest

    Learn what DNS is, how name resolution works, and how to leverage it in a pentest: zone transfer, subdomain enumeration, cache poisoning, tunneling, and defenses.

    Discover more Discover more
  • SSH Port 22: Enumeration, Brute Force, Tunneling, and Hardening
    networking

    SSH Port 22: Enumeration, Brute Force, Tunneling, and Hardening

    Learn about SSH port 22, one of the most common pentest targets: discover enumeration, brute force, user enumeration, stolen keys, SSH tunneling, and effective hardening of the Secure Shell protocol.

    Discover more Discover more
  • TCP Port 8080: Tomcat, Jenkins, and High-Impact Web Vulnerabilities
    networking

    TCP Port 8080: Tomcat, Jenkins, and High-Impact Web Vulnerabilities

    Port 8080 often hosts Apache Tomcat and Jenkins, two key targets in web pentesting. Learn about enumeration, Tomcat Manager, Jenkins RCE, and the most useful tests for the most critical web vulnerabilities.

    Discover more Discover more
  • Port 5985 WinRM: Evil-WinRM, Pass-the-Hash, and PowerShell Remoting
    networking

    Port 5985 WinRM: Evil-WinRM, Pass-the-Hash, and PowerShell Remoting

    Port 5985 exposes WinRM over HTTP, the Microsoft service used by PowerShell Remoting. Learn about enumeration, access with Evil-WinRM, Pass-the-Hash, lateral movement, and hardening in Active Directory environments.

    Discover more Discover more
  • MySQL Port 3306: Dump Database, LOAD_FILE and Webshell via INTO OUTFILE
    networking

    MySQL Port 3306: Dump Database, LOAD_FILE and Webshell via INTO OUTFILE

    MySQL port 3306: a practical pentest guide with brute force credentials, database dumps, LOAD_FILE, webshell via INTO OUTFILE, UDF for RCE, and escalation techniques.

    Discover more Discover more
  • Socat: The Swiss Army Knife of Networking for Pentesting and Pivoting
    networking

    Socat: The Swiss Army Knife of Networking for Pentesting and Pivoting

    Socat for advanced networking: relay, port forwarding, reverse shell, and encrypted tunnels. The Swiss Army Knife for network connections in pentesting.

    Discover more Discover more
  • Shodan: A Guide to Dork, Advanced Queries and Filters (2026)
    networking

    Shodan: A Guide to Dork, Advanced Queries and Filters (2026)

    Shodan: Practical dorks for MongoDB, IoT, ICS and CVE, advanced filters, CLI, API, InternetDB and complete cheat sheet for passive reconnaissance and pentesting (2026).

    Discover more Discover more
  • RSH: Clear Text Remote Shell on Unix Systems
    networking

    RSH: Clear Text Remote Shell on Unix Systems

    RSH: Clear Text Remote Shell on Unix Systems

    Discover more Discover more
  • RevSocks: Reverse SOCKS Proxy for Pivoting and Internal Access
    networking

    RevSocks: Reverse SOCKS Proxy for Pivoting and Internal Access

    RevSocks creates a reverse SOCKS proxy between the attacker and the compromised target, allowing pivoting and access to internal networks in authorized pentests.

    Discover more Discover more
  • NBTSscan: Fast NetBIOS Enumeration on Windows Networks
    networking

    NBTSscan: Fast NetBIOS Enumeration on Windows Networks

    NBTSscan is a lightweight NetBIOS enumeration tool for Windows networks. It identifies hostnames, domains, and MAC addresses via NetBIOS queries.

    Discover more Discover more
  • NC: The Swiss Army Knife of TCP/UDP Connections
    networking

    NC: The Swiss Army Knife of TCP/UDP Connections

    NC is a versatile tool for TCP/UDP connections, port scanning, banner grabbing and reverse shell in authorized penetration testing.

    Discover more Discover more
  • ProxyChains: Chaining Proxies for Anonymity and Pivoting in Pentesting
    networking

    ProxyChains: Chaining Proxies for Anonymity and Pivoting in Pentesting

    ProxyChains: A practical guide to anonymizing traffic and chaining proxies in penetration testing. Configuration, SOCKS5, and tool integration.

    Discover more Discover more
  • SSHuttle: VPN over SSH for Pivoting in Penetration Testing
    networking

    SSHuttle: VPN over SSH for Pivoting in Penetration Testing

    SSHuttle: A complete guide to creating VPNs over SSH for penetration testing. Pivoting, tunneling, and accessing internal networks without configuration.

    Discover more Discover more
  • Rsync Port 873: Enumeration, Anonymous Access and Exploitation
    networking

    Rsync Port 873: Enumeration, Anonymous Access and Exploitation

    Pentest Rsync on port 873: enumerates rsyncd and modules, verifies anonymous and write access, analyzes exposed files and possible attack paths.

    Discover more Discover more
  • Telnet Door 23: Exploitation, Credential Abuse and Pivoting
    networking

    Telnet Door 23: Exploitation, Credential Abuse and Pivoting

    Learn how to exploit Telnet on port 23 during a pentest: enumeration, banner grabbing, credentials, privilege escalation, pivoting, and lateral movement.

    Discover more Discover more