Doors | Hackita

Doors Category

blog: 123+ Note
Focus: OSCP · Red Team
Structure: Recon → Exploit

Doors blog

Filters

Categories

Sub-category

Recon & mapping
Networking
Port by port, service by service: what to expect, what to try, and which exploits to remember for each protocol.
Discover more Discover more
networking
Port 2375 Docker API: Enumeration, RCE, and Hardening
Port 2375 Docker API pentest: Test unauthenticated access, get RCE and root on the host, and apply detection, TLS, firewall, and hardening.
Discover more Discover more
networking
HTTP Port 80: Operational Guide (Ports/Protocols) in Pentesting
Port 80 in pentest lab: scan, HTTP fingerprint, vhost enum, directory brute force, misconfig and detection. Workflow with Nmap/ffuf/curl.
Discover more Discover more
networking
TCP/UDP Ports in Penetration Testing: A Complete Guide from Recon to Exploit
All TCP and UDP ports in penetration testing, organized by attack scenario: Active Directory, web, database, mail, DevOps. Attack vectors and complete technical guides for OSCP and red teams.
Discover more Discover more
networking
Port 137 NetBIOS: Responder, NTLM Relay, and Credential Theft on AD
NetBIOS on port 137 enabled? Responder captures NTLMv2 hashes in minutes, ntlmrelayx executes commands without cracking. Chain from NBT-NS poisoning to Domain Admin for pentest.
Discover more Discover more
networking
Port 138 NetBIOS Datagram: Windows Broadcast Service Penetration Testing Guide
Port 138 open? The attack surface is minimal in 2026, but it indicates NetBIOS is enabled. Focus on port 137 with Responder and 445 with SMB—those are the real vectors.
Discover more Discover more
networking
RPCbind Port 111: NFS Mount, UID Bypass and NIS Credential Dump
RPCbind on 111? Enumerate NFS and NIS with rpcinfo, mount anonymous shares, bypass root_squash with UID matching, and steal SSH keys or password hashes. Chain to root in minutes.
Discover more Discover more
networking
Door 113 Ident: What It Is and What to Do if You Find It Open in 2026
Port 113 open? Ident is nearly defunct, but it reveals usernames and points to vulnerable legacy systems. Learn how to enumerate and what to look for next.
Discover more Discover more
networking
NNTP Port 119: A Guide to Penetration Testing the Network News Transfer Protocol
Port 119 open? NNTP is nearly defunct, but it can expose newsgroups with cleartext credentials, usernames, and confidential data. Learn how to enumerate and exploit it.
Discover more Discover more
networking
Port 139 NetBIOS Session: Null Session, EternalBlue, and SMB Relay on AD
Port 139 open? Enumerate users with null sessions, exploit MS17-010 over SMBv1, and use ntlmrelayx if signing is disabled. Chain a Domain Admin in 27 minutes.
Discover more Discover more
networking
DHCP Port 67: Rogue Server, Starvation, and MITM on the Internal Network
Port 67 without DHCP snooping? Deploy a rogue server with dnsmasq, poison gateways and DNS, capture NTLMv2 hashes with Responder, and get to Domain Admin in 90 minutes.
Discover more Discover more
networking
Port 95 SUPDUP: Remote Terminal Protocol Deprecated (Historical Relevance)
Port 95 open during a scan? SUPDUP has been defunct since the 90s. Learn how to identify the real service: hidden web server, custom app, or honeypot.
Discover more Discover more
networking
Port 49 TACACS+: Shared Secret Crack and Network Takeover Cisco
TACACS+ on Route 49 with a weak shared secret? Bruteforce the key, decrypt the traffic with Wireshark, and take control of every router, switch, and firewall in the Cisco infrastructure.
Discover more Discover more
networking
PointCast Gate 90: What It Is and What to Do If You Find It Open in 2026
Port 90 open during a scan? PointCast has been dead since 2001. Learn how to identify the real service, whether it's a hidden web server, proxy, or custom app.
Discover more Discover more
networking
Port 37 Time Protocol: OS Fingerprinting and Recon on Legacy Systems
Port 37 open? Time Protocol reveals OS (Windows Server 2003/2008, Cisco IOS), timestamp, and uptime. Immediate red flag for legacy technology—chain to EternalBlue in 15 minutes.
Discover more Discover more
networking
WINS Port 42: Complete Map of Windows Network Without Authentication
WINS on port 42 without authentication: enumerates domain controllers, file servers, and logged-in users via NetBIOS. Instant red flag for legacy Windows—chain to AD in 20 minutes.
Discover more Discover more
networking
Port 27018 MongoDB Cluster: Accessing Internal Nodes and Oplog Dump
Port 27018 exposed? Connect directly to the replica set secondaries, read the oplog with cleartext password, bypass the keyfile, and pivot into cluster nodes.
Discover more Discover more
networking
Port 28017 MongoDB HTTP: Information Disclosure and REST API Without Auth
Port 28017 open? Read version, hostname, and logs without credentials, dump data via REST API, and pivot to 27017. Only on legacy MongoDB ≤ 3.4, often unpatched.
Discover more Discover more
networking
RDP Port 33389: Finding and Exploiting RDP on Non-Standard Ports
RDP moved to 33389? nmap -sV finds it in seconds. BlueKeep, Pass-the-Hash, and brute force work identically. Changing ports isn't security—it's a placebo.
Discover more Discover more
networking
Port 50000 SAP NetWeaver: from SAP* Default to RCE on ERP Enterprise
SAP Management Console on 50000 without auth: Enumerate versions, exploit RECON (CVSS 10), abuse RFC with SAP*/06071992 and get OS command execution on all ERP data.
Discover more Discover more
networking
Port 50070 Hadoop NameNode: Download Petabytes of Data and RCE via YARN
HDFS without Kerberos on 50070? Browse the filesystem, download CDRs and PIIs via WebHDFS with user.name=hdfs, then get a shell to the cluster via the YARN REST API.
Discover more Discover more
networking
ActiveMQ Port 61616: CVE-2023-46604 RCE Pre-Auth and admin Credentials:admin
Unpatched ActiveMQ on 61616? CVE-2023-46604 gives root shell in 8 seconds via OpenWire. Web console with admin:admin, messages with JDBC credentials, and lateral movement to Oracle.
Discover more Discover more
networking
Memcached Port 11211: Pentest and Data Dump 2026
Memcached opened without authentication: dump session token, credentials, and JWT with nc. 51.000x UDP amplification, cache poisoning, and hardening explained.
Discover more Discover more
networking
Port 15672 RabbitMQ: guest:guest to RCE with Erlang Cookie
RabbitMQ management exposed on 15672? With guest:guest, read every message in the queue, dump hashes, and get RCE via Erlang cookies. Practical offensive guide.
Discover more Discover more
networking
Port 16010 HBase: Dump Billions of Records Without Authentication
HBase Master UI on 16010 without authentication: enumerate tables, dump data via REST API and Thrift, read tokens and CDRs. Full pentest with scan, Hadoop lateral movement.
Discover more Discover more
networking
MongoDB Port 27017: Passwordless Access, NoSQL Injection, and Data Dumps
MongoDB exposed on 27017? Login without authentication, bypass $ne login, dump credentials and MFA secret, and perform privilege escalation. Complete pentest with live payloads.
Discover more Discover more
networking
Webmin Port 10000: RCE Backdoor and Instant Root
Port 10000 Webmin: CVE-2019-15107 pre-auth RCE root backdoor, CVE-2022-0824 file manager, CVE-2024-12828 CVSS 9.9, Metasploit modules, and post-exploitation with full root access.
Discover more Discover more
networking
Elasticsearch Port 9200: Dump Indexes, Credentials, and Groovy RCE
Port 9200 Elasticsearch without authentication: Index dumps with credentials and PII, password lookup in logs, Groovy script RCE, CVE-2015-1427, elasticdump, and lateral movement from ELK stack.
Discover more Discover more
networking
Port 9000 Pentest: PHP-FPM RCE, SonarQube, and Portainer
Port 9000: Direct RCE via PHP-FPM FastCGI exposed, SonarQube admin:admin with hardcoded source code and credentials, Portainer without initial setup and container escape.
Discover more Discover more
networking
Port 9090 Pentest: Prometheus, Cockpit Linux and JBoss RCE
Port 9090: Authless Prometheus exposes entire infrastructure and credentials, Cockpit provides a Linux shell in the browser, and JBoss WAR deploys for RCE. Operational cheat sheet included.
Discover more Discover more
networking
Kafka Pentest Port 9092: Message Interception and Message Injection
Port 9092 Apache Kafka without authentication: topic list, real-time message interception, message injection, Kafka Connect credentials JDBC and full offensive chain.
Discover more Discover more
networking
Port 9300 Elasticsearch Transport: Cluster Join and Java RCE
Elasticsearch transport port 9300: Unauthorized cluster join, data replication to malicious node, Java deserialization RCE CVE-2015-5377, and operational differences from port 9200.
Discover more Discover more
networking
Port 9418 Git Daemon: Pentest, Clone Repository and Secret Extraction
Port 9418: Authenticationless git daemon: Repository clone, credential extraction from commit history, truffleHog, gitleaks, web-exposed .git, and lateral movement from source code.
Discover more Discover more
networking
Port 9999 Pentest: Abyss, Icecast CVE-2004-1561, and Dev Server
Port 9999: Abyss Web Server directory traversal and admin bypass, Icecast buffer overflow RCE CVE-2004-1561, Varnish admin exposed, unprotected server staging and backdoor detection.
Discover more Discover more
networking
Oracle EBS Pentest: Port 7777, OHS and CVE 2026
Offensive guidance on Oracle HTTP Server port 7777: OHS enumeration, EBS and PeopleSoft default credentials, CVE-2022-21587, PL/SQL gateway injection, SSRF, and lateral movement.
Discover more Discover more
networking
Port 8000 Pentest: Django Debug, Python http.server and RCE
Port 8000 offensive guide: Django DEBUG=True, Python http.server directory listing, Flask Werkzeug console, PHP built-in server and credential extraction. With cheat sheets.
Discover more Discover more
networking
HTTP-alt Port 8008: Grafana, Splunk, and Internal Pentest APIs
Alternative HTTP port 8008: Grafana and Splunk default credentials, CVE-2021-43798 path traversalSpring Boot Actuator heapdump, internal REST APIs and credential extraction.
Discover more Discover more
networking
Port 8081 Pentest: Nexus Repository, Traefik and OWASP API
Port 8081: Nexus Repository default credentials, CVE-2019-7238 RCE, Traefik dashboard without auth, OWASP API Security Top 10 with operational payloads and supply chain attacks.
Discover more Discover more
networking
Port 8443 HTTPS Pentest: vCenter, pfSense, UniFi and CVE
Alternative HTTPS port 8443: VMware vCenter CVE-2021-21972, pfSense RCE, UniFi Log4Shell, Cisco ASDM default credentials, certificate intelligence, and TLS hardening.
Discover more Discover more
networking
Port 8888 Jupyter Notebook: Direct RCE and Credential Extraction
Port 8888 Authentication-free Jupyter Notebook: Direct code execution, token leak, integrated terminal, hardcoded credentials in notebooks, and real-world step-by-step attack chain.
Discover more Discover more
networking
Neo4j Pentest: Cypher Injection, APOC RCE and Port 7474
Neo4j port 7474/7687 pentest: enumeration, default credentials, cypher injection, APOC RCE, hash dump, and API key. Complete guide 2026.
Discover more Discover more
networking
Port 7070 Pentest: RealServer, Helix and AnyDesk
Port 7070 open? 2026 Pentest Guide: What is it, Helix/RealServer enumeration, RTSP exploits, directory traversal, AnyDesk, and Java app server.
Discover more Discover more
networking
Port 5601 Kibana: Dev Tools, Log Leak and Elasticsearch
Kibana Port 5601 in Pentest: Dev Tools Console, Elasticsearch Queries, Log Exposure, Internal Hosts, and Sensitive Credentials in Indexed Data
Discover more Discover more
networking
VNC Port 5900: No Auth, Brute Force, and Remote Desktop
Port 5900 VNC in the pentest: remote desktop access, unauthenticated instances, password brute force, screenshots, and session hijacking.
Discover more Discover more
networking
Port 5986 WinRM HTTPS: Certificates, ADCS, and Evil-WinRM
WinRM HTTPS port 5986 in the pentest: client certificates, Evil-WinRM over TLS, ADCS abuse, and remote access via certificate-based authentication.
Discover more Discover more
networking
Port 6000 X11: Screenshots, Keylogging and Desktop Hijack
Port 6000 X11 in the pentest: exposed remote display, desktop screenshots, keylogging, input injection and session hijacking on Linux and Unix systems.
Discover more Discover more
networking
Port 6379 Redis: No Auth, RCE and Credential Dump
Redis port 6379 in pentest: unauthenticated login, key and session dumps, SSH key injection, malicious modules, and RCE.
Discover more Discover more
networking
Port 6443 Kubernetes API: Tokens, Secrets, and Cluster Admin
Port 6443 Kubernetes APIs in the pentest: ServiceAccount token, secret extraction, pod access, escalation to cluster-admin, and cluster compromise.
Discover more Discover more
networking
Port 6667 IRC: UnrealIRCd, C2 and Information Gathering
IRC port 6667 in the pentest: server and channel enumeration, user and hostname info leak, C2 botnet, UnrealIRCd, and hijacking risks.
Discover more Discover more
networking
WebLogic Port 7001: T3, Admin Console, and RCE
WebLogic port 7001 in pentest: T3 protocol, admin console, CVE RCE pre-auth, SSRF, and Oracle WebLogic Server access exposed.
Discover more Discover more
networking
WebLogic SSL port 7002: HTTPS, T3S and RCE
WebLogic SSL Port 7002 in Pentest: HTTPS Console, T3S, TLS Certificates, Pre-Auth CVEs, and Attacks on Encrypted Oracle WebLogic Server.
Discover more Discover more
networking
SVN Port 3690: Exposed Repositories and Secret Leakage
Bring 3690 SVN to the pentest: exposed repositories, anonymous checkout, commit history, source code disclosure, and recoverable credentials.
Discover more Discover more
networking
Spark UI Port 4040: Pentest, Credentials, and Cluster Map
Bring 4040 Spark UI to pentest: environment leak, worker discovery, exposed credentials, and pivot to 6066 REST API and big data cluster.
Discover more Discover more
networking
Port 4500 IPsec NAT-T: VPN, IKE and PSK Cracking
Port 4500 IPsec NAT-T in the pentest: IKE, NAT traversal, aggressive mode, PSK cracking and exposed VPN surface analysis.
Discover more Discover more
networking
Port 5000 Docker Registry and Flask: Debug, RCE and Secret Leak
Port 5000 in pentest: Docker Registry exposed with downloadable images and secrets, or Flask debug with console tool and RCE from the browser.
Discover more Discover more
networking
Port 5672 RabbitMQ: AMQP, Code and Management API
RabbitMQ port 5672 to the pentest: AMQP queues and messages, exposed credentials, Management API 15672, injection and Erlang cookie risk.
Discover more Discover more
networking
Port 2082 cPanel: Pentest, Credential Reuse and Webshell
Port 2082 cPanel in the pentest: unencrypted HTTP login, credential reuse, upload via File Manager, database access, email, and backups.
Discover more Discover more
networking
Port 2083 cPanel SSL: Pentest, API and HTTPS Login
Port 2083 cPanel SSL in pentest: HTTPS login, TLS enumeration, cPanel API, file upload, post-auth automation, and cPHulk checks.
Discover more Discover more
networking
Port 2181 ZooKeeper: Pentest, Dump, and Four-Letter Commands
Port 2181 ZooKeeper into the pentest: four-letter commands, dump configurations, cluster enumeration, and sensitive metadata.
Discover more Discover more
networking
Port 2376 Docker TLS API: Pentest and mTLS
Port 2376 Docker TLS API in pentest: TLS enumeration, mutual TLS, client certificate theft, misconfigurations, and remote daemon access
Discover more Discover more
networking
Port 2483 Oracle DB: TNS Listener, SID and Pentest
Oracle DB Port 2483 in Pentest: TNS Listener, SID and Service Name Enumeration, Credential Brute Force, DBA Escalation, and System Access Techniques
Discover more Discover more
networking
Port 2484 Oracle TCPS: Wallet, TLS and Pentest
Oracle TCPS port 2484 in pentest: Encrypted TNS Listener, certificates and Oracle Wallet, TLS enumeration and differences with 2483.
Discover more Discover more
networking
Port 2701 TVersity: Web UI and Information Disclosure
Port 2701 TVersity in the pentest: media server with exposed web UI, shared file disclosure and access surface analysis.
Discover more Discover more
networking
3260 iSCSI port: Pentest, Target, LUN and CHAP
Bringing the 3260 iSCSI to the pentest: target and LUN discovery, storage volume access, CHAP, remote disk mounts, and exposed data analysis.
Discover more Discover more
networking
Port 3478 STUN/TURN: NAT Traversal, Relay Abuse, and Pentest
Port 3478 STUN/TURN in pentest: NAT traversal, IP leak, NAT type, TURN relay abuse and misconfigurations in WebRTC and VoIP infrastructures.
Discover more Discover more
networking
Port 3632 DistCC: Direct RCE and CVE-2004-2687
DistCC Port 3632 in Pentest: distccd exposed, RCE without authentication via CVE-2004-2687, Nmap NSE verification, and immediate impact
Discover more Discover more
networking
Port 1991 cPanel and WHM: Pentesting, Enumeration, and Hardening
cPanel and WHM Pentest Guide: 2083, 2087, and Webmail 2096 Panels, Account Enumeration, APIs, Hosting Exposure, and Critical Misconfigurations
Discover more Discover more
networking
Port 1434 MSSQL: SQL Server Browser and Instance Discovery
MSSQL Pentest on port 1434/UDP: SQL Server Browser enumeration, named instance, version, dynamic ports, and SQL instance discovery in lab.
Discover more Discover more
networking
Citrix ICA Port 1604: ICA Browser, Published Apps, and StoreFront
Citrix Pentest on port 1604/UDP: ICA Browser enumeration, published apps, StoreFront, 1494/2598 services, and access to Citrix Virtual Apps environments in lab.
Discover more Discover more
networking
PPTP Port 1723: MS-CHAPv2 and VPN Credentials
PPTP Pentest on Port 1723: What it is, Control Channel Fingerprinting, MS-CHAPv2 Analysis, Legacy VPN Credentials, GRE, and Internal Network Access Risk.
Discover more Discover more
networking
RADIUS Port 1812: Shared Secret, EAP, and Network Access
RADIUS Pentest on Port 1812/UDP: Test Shared Secret, EAP Authentication, AD/LDAP Backend, RADIUS Accounting, and Network Access Control in the Lab.
Discover more Discover more
networking
Port 1813 RADIUS Accounting: Sessions, Assigned IPs, and RADIUS 1812
Pentest RADIUS Accounting on port 1813/UDP: session tracking, Framed-IP, Accounting-Request, correlation with 1812 and visibility into network sessions in the lab.
Discover more Discover more
networking
Port 1883 MQTT: Pentest, Topic Enumeration and Injection
Port 1883 MQTT in IoT pentest: topic enumeration, anonymous subscription, message injection, and clear text credentials on exposed brokers.
Discover more Discover more
networking
SSDP/UPnP Port 1900: Pentest, Port Mapping, and SSRF
Port 1900 SSDP/UPnP in pentest: device discovery, port mapping abuse, SSRF via CallStranger, and exposed services analysis.
Discover more Discover more
networking
HASP Port 1947: Pentest and Sentinel Admin Control Center
Port 1947 HASP in the pentest: Sentinel Admin Control Center, dongle enumeration and active licenses, version check and License Manager RCE risks.
Discover more Discover more
networking
Port 1984 Xymon/BigBrother: Recon and Info Disclosure
Brings 1984 Xymon and BigBrother to the pentest: agent monitoring, host data disclosure, exposed services, and infrastructure dashboard accessible without adequate controls.
Discover more Discover more
networking
UPnP Port 1990: SOAP, Port Mapping and Device Control
Port 1990 UPnP in the pentest: SOAP action, port mapping abuse, device control and analysis of IGD services exposed on the router.
Discover more Discover more
networking
SNMP Port 1993: Inform, Trap and Monitoring
Bring 1993 SNMP into the pentest: SNMP Inform, trap correlation, community string, alternative collectors and information disclosure on monitoring servers.
Discover more Discover more
networking
NFS port 2049: Pentest, no_root_squash, and Lateral Movement
Port 2049 NFS in the pentest: export enumeration, remote mount, UID spoofing, no_root_squash, SSH key injection, and privesc Linux.
Discover more Discover more
networking
PostgreSQL port 5432: Payload, pg_shadow, COPY PROGRAM and RCE
PostgreSQL pentest on port 5432: enumeration, brute force, pg_shadow, file read/write, COPY PROGRAM, RCE and privilege escalation in lab.
Discover more Discover more
networking
POP3 Port 110: Brute Force, Credential Sniffing, and Mailbox Access
Port 110 exposes POP3, the protocol used to download email from the server to the client. A practical guide to enumeration, brute force, cleartext credential sniffing, message downloading, and mail server hardening.
Discover more Discover more
networking
OpenVPN Port 1194: .ovpn Files, VPN Credentials, and Internal Access
OpenVPN pentest on port 1194: UDP/TCP fingerprinting, .ovpn file analysis, credential testing, client certificates, and internal network access in the lab.
Discover more Discover more
networking
Port 1352 Lotus Notes/Domino: NRPC, names.nsf and WebAdmin
Lotus Notes/Domino pentest on port 1352: NRPC enums, names.nsf, Domino Directory, NSF databases, WebAdmin, and weak logins in legacy environments.
Discover more Discover more
networking
IMAP Port 143: Mailbox Access, Brute Force, and Mail Server Enumeration
Port 143 exposes IMAP, the protocol used to access and synchronize email and folders directly on the server. A practical guide to enumeration, login testing, mailbox discovery, and mail server hardening.
Discover more Discover more
networking
Port 1521 Oracle DB: TNS Listener, SID and Privilege Escalation
Oracle Pentest 1521: TNS Listener enumeration, payload, SID, and service name, weak credential testing, SQL injection, escalation to DBA, and lateral movement in the lab.
Discover more Discover more
networking
SMTP Port 25: User Enumeration, Open Relay, and SMTP AUTH
SMTP port 25 can expose user enumeration via VRFY and RCPT TO, open relay, email spoofing, and brute force on SMTP AUTH. A practical guide to mail server enumeration, exploits, detection, and hardening.
Discover more Discover more
networking
Port 43 WHOIS: OSINT on Domains, IPs and Name Servers
WHOIS port 43 allows passive queries on domains, IPs, and ASNs to gather registrars, name servers, contacts, and expiration dates for reconnaissance and OSINT.
Discover more Discover more
networking
Port 5000: Docker Registry, Flask Debug, and UPnP
Bring 5000 into the pentest: recognize Docker Registry, Flask debug, UPnP or Synology DSM. Enumeration, image pull, RCE Werkzeug and SOAP abuse in lab.
Discover more Discover more
networking
Port 1026 MS RPC: Windows dynamic endpoints, port 135 and remoting.
Learn what port 1026 is in MS RPC, why it correlates with the endpoint mapper on 135, and how dynamic RPC ports change between legacy and modern Windows systems, impacting enumeration, firewalling, and lateral movement.
Discover more Discover more
networking
TCP Port 1080: SOCKS Proxy and Pivoting in the Internal Network
Port 1080 can expose an open SOCKS proxy that can be used for pivoting, tunneling, and internal network access. Learn how to identify, test, and exploit it in authorized pentests.
Discover more Discover more
networking
Port 21 FTP: Anonymous Login, Brute Force and Exploits
FTP port 21 remains a key pentest target: discover enumeration, anonymous login, brute force, file uploads, vsftpd and ProFTPD exploits, detection, and practical hardening.
Discover more Discover more
networking
Telnet Port 23: Clear Text Credentials, Sniffing, and Brute Force
Telnet port 23 is an immediate critical finding: it transmits credentials in clear text, facilitating brute force, sniffing, and insecure remote access. Learn how to enumerate, attack, and secure it.
Discover more Discover more
networking
Port 1025 MS RPC: Windows dynamic endpoints, port 135 and lateral movement.
Learn what port 1025 is in MS RPC, why it correlates with the endpoint mapper on 135, and how dynamic RPC ports depend on the Windows version: 1025-5000 on legacy systems, 49152-65535 from Windows Vista/Server 2008 onwards.
Discover more Discover more
networking
Port 912 Apex Mesh / MeshCentral: RMM servers, remote agents, and centralized compromise.
Learn what port 912 is associated with apex-mesh and why it might indicate a remote management platform like MeshCentral: centralized access to endpoints, remote agents, and high-impact surface area for the entire managed network.
Discover more Discover more
networking
Port 990 FTPS: Anonymous login, brute force, and file exfiltration over encrypted FTP.
Learn what port 990 ftps is, how it relates to port 989 ftps-data, and why anonymous logins, weak credentials, and exposed backups remain the primary risks of TLS-protected file transfers.
Discover more Discover more
networking
POP3S Port 995: Brute force, mailbox dump, and credential reuse on encrypted emails.
Learn what POP3S port 995 is, why POP3 over TLS uses implicit encryption on the email channel, and how weak credentials, mailbox access, and sensitive content still make POP3S a relevant target.
Discover more Discover more
networking
Port 880 Kerberos Admin: KDC kadmin, kpasswd and password policy.
Learn what port 880 is associated with legacy or custom Kerberos admin services, how it relates to kadmin and kpasswd, and why password policies, principals, and KDC configuration are valuable for Kerberos enumeration.
Discover more Discover more
networking
Port 902 VMware ESXi: vCenter, vmware-authd, and hypervisor risk.
Learn what VMware port 902 is, used in core communications between vCenter Server and ESXi, and why identifying a host with vmware-authd is a high-impact surface for your entire virtual infrastructure.
Discover more Discover more
networking
Port 989 FTPS-Data: Encrypted data channel, implicit TLS and file transfer security.
Learn what ftps-data port 989 is, how it relates to port 990 in implicit FTPS, and why certificates, TLS, and access permissions remain crucial to evaluating file transfer security.
Discover more Discover more
networking
LDAPS port 636: Active Directory enumeration, TLS certificates, and AD CS abuse.
Learn what LDAPS port 636 is, how LDAP over SSL can reveal your hostname, domain, and enterprise CA, and why LDAP signing and channel binding remain crucial for reducing Active Directory relay and exposure.
Discover more Discover more
networking
Port 513 Rlogin: .rhosts trust, root access and legacy Unix lateral movement
Learn what Rlogin port 513 is, how .rhosts and hosts.equiv work, why trust can open passwordless logins, and how to identify trust chains and lateral movement on legacy Unix systems.
Discover more Discover more
networking
Port 554 RTSP: default credentials, vendor path, and IP camera video feeds.
Learn what RTSP port 554 is, how to detect paths from Hikvision, Dahua, and other vendors, and why CCTV, DVR, and NVR streams with weak or no authentication pose a real risk to video surveillance.
Discover more Discover more
networking
Port 587 SMTP Submission: user enumeration, STARTTLS and email credentials.
Find out what SMTP Submission port 587 is, how authenticated email sending works according to RFC 6409, and why STARTTLS and SMTP AUTH are crucial for evaluating the security of your email service.
Discover more Discover more
networking
Port 593 RPC over HTTP: IOXIDResolver, endpoint enumeration and DCOM stealth.
Learn what http-rpc-epmap port 593 is, how ncacn_http works in a Microsoft environment, and why RPC over HTTP can expose endpoints, DCOM services, and useful information about the enterprise RPC surface.
Discover more Discover more
networking
IPMI port 623: RAKP hash disclosure, cipher 0 and out-of-band BMC risk.
Learn what port 623/UDP asf-rmcp is, how IPMI 2.0 works with RAKP, and why CVE-2013-4786 allows hash recovery from BMC responses, while cipher suite 0 support can drastically reduce remote management security.
Discover more Discover more
networking
Port 631 IPP/CUPS: RCE chain, cups-browsed and Linux print server compromise.
Learn what IPP/CUPS port 631 is, how the Internet Printing Protocol over TCP and UDP 631 works, and why the 2024 cups-browsed vulnerability chain brought RCE, printer discovery, and Linux print server security back to the forefront.
Discover more Discover more
networking
HTTPS Port 443: What It Is, How It Works, and the Security Risks of TLS and Web Apps
Learn what HTTPS port 443 is for, how TLS, certificates, and virtual hosts work, and the risks it introduces, including exposed hostnames in SANs, TLS misconfigurations, sensitive files, admin panels, and web attack surfaces.
Discover more Discover more
networking
SMTPS Port 465: What it is, how it works, and the security risks of TLS mail submission.
Learn what SMTPS port 465 is used for, how SMTP Submission over TLS works, and what risks it introduces, including user enumeration, open relay, brute force SMTP AUTH, and internal phishing with valid credentials.
Discover more Discover more
networking
ISAKMP Port 500: IPsec VPN, IKEv1 Aggressive Mode and PSK Crack
ISAKMP port 500 in pentest: IPsec VPN enumeration, IKE fingerprinting, Aggressive Mode, PSK hash extraction, offline cracking, and tunneling to internal network.
Discover more Discover more
networking
Rexec Port 512: What It Is, Vulnerability, and a Complete Pentest Guide
Rexec Port 512: What it is, how it works, and how to test it in a pentest. Enumeration, cleartext credential sniffing, credential spraying, command execution, and risks of legacy Unix systems.
Discover more Discover more
networking
Syslog Port 514: Cleartext Logs, Syslog Injection, and UDP Collector Risk
Learn what syslog port 514/UDP is, how to identify collectors and logging streams, what data can travel in the clear, and why syslog over TLS on 6514 reduces eavesdropping and spoofing.
Discover more Discover more
networking
LPD Port 515: File read, queue enumeration, and legacy print server risks
Learn what LPD port 515 is, how the Line Printer Daemon defined in RFC 1179 works, and why print queues, Unix/Linux print servers, and legacy services can expose sensitive information and overlooked attack surfaces.
Discover more Discover more
networking
RIP Port 520: Route Sniffing, Route Injection, and MitM Risk on Legacy Networks
Learn what port 520/UDP used by RIP is, how RIPv1 and RIPv2 work, and why route advertisements can expose network topology and increase the risk of route poisoning, traffic redirection, and path manipulation.
Discover more Discover more
networking
IRC Port 194: What It Is, How It Works, and Differences Between Ports 6667 and 6697
Learn what IRC port 194 is for, why many servers use 6667 or 6697, how the protocol works, and the risks it introduces, including user enumeration, channels, internal hostname leaks, and vulnerable daemons.
Discover more Discover more
networking
SMUX Port 199: What It Is, How It Works, and SNMP Security Risks
Learn what SMUX port 199 does, how it connects SNMP subagents and master agents, what risks it introduces when exposed to the network, and how to analyze registrations, OIDs, and misconfigurations in legacy systems.
Discover more Discover more
networking
FTP Ports 20 and 21: What the Protocol Is, How It Works, and Where It Actually Attacks
A practical guide to FTP (File Transfer Protocol) ports 20 and 21: the difference between control and data channels, active/passive mode, sniffing risks, FTP bounces, and common vulnerabilities in legacy servers and labs.
Discover more Discover more
networking
BGP Port 179: What It Is, How It Works, and Routing Security Risks
Learn what BGP port 179 is used for, how Autonomous System peering works, what risks a misconfigured session introduces, and how to analyze enumeration, route injection, and hijacking in an authorized pentest/CTF.
Discover more Discover more
networking
Squid Proxy Port 3128: What It Is, How It Works, and Security Risks
Learn what Squid port 3128 is used for, how an HTTP/HTTPS forward proxy works, the risks a misconfigured open proxy introduces, and how to exploit or defend against it in pivoting, access to internal services, and ACL control.
Discover more Discover more
networking
RDP Port 3389: What is Remote Desktop, How it Works, and Security Risks
Learn what RDP port 3389 is used for, how Remote Desktop, NLA, and CredSSP work, what risks service exposure introduces, and how to attack or defend against brute force, BlueKeep, and lateral movement.
Discover more Discover more
networking
SSH Port 22: Enumeration, Brute Force, Tunneling, and Hardening
Learn about SSH port 22, one of the most common pentest targets: discover enumeration, brute force, user enumeration, stolen keys, SSH tunneling, and effective hardening of the Secure Shell protocol.
Discover more Discover more
networking
TCP Port 8080: Tomcat, Jenkins, and High-Impact Web Vulnerabilities
Port 8080 often hosts Apache Tomcat and Jenkins, two key targets in web pentesting. Learn about enumeration, Tomcat Manager, Jenkins RCE, and the most useful tests for the most critical web vulnerabilities.
Discover more Discover more
networking
Port 5985 WinRM: Evil-WinRM, Pass-the-Hash, and PowerShell Remoting
Port 5985 exposes WinRM over HTTP, the Microsoft service used by PowerShell Remoting. Learn about enumeration, access with Evil-WinRM, Pass-the-Hash, lateral movement, and hardening in Active Directory environments.
Discover more Discover more
networking
MySQL Port 3306: Dump Database, LOAD_FILE and Webshell via INTO OUTFILE
MySQL port 3306: a practical pentest guide with brute force credentials, database dumps, LOAD_FILE, webshell via INTO OUTFILE, UDF for RCE, and escalation techniques.
Discover more Discover more