Common Ports

21 - FTP

Many FTP servers allow anonymous users and might be misconfigured and give too much access. Always try to login as an anonymous user (anonymous:anonymous). It is also important to remember the binary and ascii mode. If you upload a binary file you to put the server in binary mode typing binary and the same with text-files, typing ascii.

Connect to the FTP server:

ftp $ip
nc $ip 21

Anonymous FTP dump with Nmap:

nmap -v -p 21 --script=ftp-anon.nse $ip-254

Enumerate:

nmap --script=ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221,tftp-enum -p 21 $ip

Bruteforce

hydra -l user -P /usr/share/john/password.lst [ftp://:21$ip](ftp://:21$ip)

Bruteforce with metasploit:

msfconsole -q
msf> search type: auxiliary login
msf> use auxiliary/scanner/ftp/ftp_login

Vulnerability scan:

nmap --script=ftp-* -p 21 $ip

22 - SSH

You can find the version of SSH either by scanning it with nmap or by connecting to it with nc:

User enumeration:

Bruteforce:

Bruteforce with list of users:

23 - Telnet

Telnet is considered insecure mainly because it does not encrypt its traffic. Also a quick search in exploit-db will show that there are various RCE vulnerabilities on different versions that might be worth checking out.

Bruteforce:

25 - SMTP

SMTP is a server to server service. The user receives or sends emails using IMAP or POP3. Those messages are then routed to the SMTP-server which communicates the email to another server. The SMTP-server has a database with all emails that can receive or send emails. We can use SMTP to query that database for possible email addresses. Notice that we cannot retrieve any emails from SMTP. We can only send emails.

Connect to SMTP:

Possible commands to use after connection:

Verify if root exists:

Ask the server if root belongs to a mailing list:

Check for commands:

Enumerate users:

Enumerate users with metasploit:

Enumeration and vulnerability scanning:

Bruteforce:

Testing for open relay:

53 - DNS

Find name servers

Find email servers

Subdomain bruteforcing

Reverse dns lookup bruteforcing

Zone transfer request

Finds nameservers for a given domain

Nmap zone transfer scan

Find the IP and authoritative servers

UDP 69 - TFTP

This is a FTP server but it is using UDP.

If unauthenticated access is allowed with write permissions you can upload a shell:

79 - Finger

Users enumeration:

Enumeration with user:

80 - HTTP

Nikto:

Enumeration with Nmap:

Nmap methods testing:

Nmap vulnerability scanning:

Directory discovery:

Wfuzz web bruteforcer:

Recurse level3

Banner grabbing:

Open a service using a port knock (Secured with Knockd):

WordPress Scan - WordPress security scanner:

RSH Enumeration - Unencrypted file transfer system:

Bruteforcing authentication:

Test against SQLi:

Coldfusion vulnerability scanning:

Bruteforce basic auth

88 - Kerberos

Kerberos is a protocol that is used for network authentication. Different versions are used by *nix and Windows. But if you see a machine with port 88 open you can be fairly certain that it is a Windows Domain Controller.

Test MS14-068

Passive network sniffing:

User enumeration:

Memory password extraction (pass the ticket attacks): Mimikatz

110 - POP3

This service is used for fetching emails on a email server. If the server has this port open then probably it is an email server and other clients on the network access it to fetch their emails.

If you find usernames and passwords for email accounts you can check the mail using Telnet:

111 - Rpc

Rpcbind can help us look for NFS-shares. So look out for nfs. Obtain list of services running with RPC:

Connect to an RPC share without a username and password and enumerate privileges:

Connect to an RPC share with a username and enumerate privledges:

135 - MSRPC

The Windows RPC Protocol.

Enumerate (shows if any NFS mount is exposed):

137 - NetBios

Dumping the netbios table:

139/145 - SMB/Samba

Enumeration:

Quick enumeration:

Quick vulnerability scan:

Full enumeration and vulnerability scan:

Full enumeration and vulnerability scan without brute force and dos:

All smb scripts authenticated scan:

Enumerate users:

Manual Null Session Testing:

Windows → net use \\\\$ip\\IPC$ "" /u:""

Linux → smbclient -L //$ip

See version metasploit:

MultiExploit metasploit:

Mount:

Anonymous mount:

Bruteforce:

Connecting:

Connecting with PSExec in Metasploit:

Connecting with PSExec with credentials:

161/162 - SNMP

SNMP is a network protocol used for collection, organizing and exchanging information between network devices. It runs on managed switches, routers, and server OSs for monitoring purposes. SNMP is accesed upon providing a valid community string within a UDP datagram to port 161. It is usually public. Within SNMP you can see running processes, open ports, users, windows version, installed software, etc.

Fix SNMP output values so they are human readable:

Enumeration:

Less noisy:

Based on UDP, stateless and susceptible to UDP spoofing:

SNMPv3 Enumeration:

Automate the username enumeration process for SNMPv3:

SNMP Default Credentials:

Bruteforce the community names:

Against cisco using metasploit:

Scanning using metasploit:

389/636 - LDAP

This port is usually used for Directories. Ldap directory can be understood a bit like the windows registry or a database-tree, since directory here means more like a telephone-list than a folder. Ldap is usually used to store user infomration in corporate structures. Web apps can use ldap for authentication which means you can perform ldap-injections.

Sometimes you can access ldap using an anonymous login and find some valuable data about users.

Enumeration:

443 - HTTPS

Encrypted version of the HTTP protocol. Always check for SSL vulnerabilites such as heartbleed.

OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable

OpenSSL 1.0.1g is NOT vulnerable

OpenSSL 1.0.0 branch is NOT vulnerable

OpenSSL 0.9.8 branch is NOT vulnerable

First we need to investigate if the https-page is vulnerable to heartbleed:

Open a connection

Basic SSL ciphers check:

Exploiting with metasploit:

Notes:

Look for unsafe ciphers such as Triple-DES and Blowfish

A very complete tool for SSL auditing is testssl.sh, finds BEAST, FREAK, POODLE, heart bleed, etc...

443 - TLS

Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet. A primary use case of TLS is encrypting the communication between web applications and servers, such as web browsers loading a website. TLS evolved from SSL.

Enumerating supported protocols and cipher suites:

Enumerating supported features and extensions:

Certificate review:

You should validate that:

  • The X.509 subject common name (CN) is correct for the service

  • The issuer is reputable and certificate chain valid

  • RSA or DSA public key values are longer than 2,048 bits

  • DH public parameters are longer than 2,048 bits

  • The certificate is valid and has not expired

  • The certificate is signed using SHA-256

Vulnerabilites:

  • POODLE against CBC mode ciphers within SSL 3.0

  • BEAST against CBC mode ciphers via TLS 1.0

  • Byte biases in RC4 ciphers across all SSL and TLS protocol versions

Validate if the key was generated with weak entropy:

Test failback:

Test Dos:

UDP 500 - IPsec

IPsec tries to solve the confidentiality/integrity problems of the IP protocol. It provides HMAC of the origin and encrypts data.

You can find hosts supporting ipsec with:

Validate the follow:

  • DH group can be insecure, allowing passive decryption.

  • Preshared key (PSK) might be cracked.

  • Obtaining the XAUTH once the PSK is known.

  • For more info, refer to:

https://www.trustwave.com/Resources/SpiderLabs-Blog/Cracking-IKE-Mission-Improbable-(Part-1)/

587 - Submission

Outgoing smtp-port

If Postfix is run on it it could be vunerable to shellshock: https://www.exploit-db.com/exploits/34896/

631 - Cups

Common UNIX Printing System has become the standard for sharing printers on a linux-network. You will often see port 631 open in your priv-esc enumeration when you run netstat. You can log in to it here: http://localhost:631/admin

You authenticate with the OS-users.

Find version. Test cups-config --version. If this does not work surf to http://localhost:631/printers and see the CUPS version in the title bar of your browser.

There are vulnerabilities for it so check your searchsploit.

1433 - MsSQL

Default port for Microsoft SQL database.

Enumerate MSSQL Servers on the network:

Bruteforce MsSql with metasploit:

Gain shell using gathered credentials with metasploit:

Log in to a MsSql server:

1521 - Oracle DB

Enumeration:

Bruteforce the ISD with metasploit:

Connect to the database with sqlplus

1723 - PPTP

Point-to-Point Tunneling Protocol provides remote access to mobile devices, uses TCP port 1723 for key exchange and IP protocol 47 (GRE) to encrypt data between peers.

Enumeration:

Bruteforce:

2049 - NFS

Network file system This is a service used so that people can access certain parts of a remote filesystem. If this is badly configured it could mean that you grant excessive access to users.

Show Mountable NFS Shares:

Show all mounts:

Mount a NFS share

2100 - Oracle XML DB

There are some exploits for this, so it is useful to check it out. You can use the default Oracle users to access to it. You can use the normal ftp protocol to access it.

Some default passwords here:

https://docs.oracle.com/cd/B10501_01/win.920/a95490/username.htm

Default logins → sys:sys / scott:tiger

3306 - MySQL

Nmap scan:

Vulnerability scan:

Enumeration and vulnerability scanning:

If Mysql is running as root and you have acces, you can run commands:

Always test the following:

username: root

password: root

Configuration files:

MySQL commands cheat sheet:

http://cse.unl.edu/~sscott/ShowFiles/SQL/CheatSheet/SQLCheatSheet.html

If with a shell, find login credentials for the database:

3389 - RDP

This is a proprietary protocol developed by windows to allow remote desktop.

Log in:

Bruteforce:

5900 - VNC

  • VNC is used to get a screen for a remote host

  • You can use vncviewer to connect to a vnc-service

  • Vncviewer comes built-in in Kali

  • You do not have to set a username

  • VNC is run as a specific user, so when you use VNC it assumes that user

  • If you have dumped and cracked the user password on a machine does not mean you can use them to log in

  • To find the VNC password you can use the metasploit/meterpreter post exploit module that dumps VNC passwords

Scan for logins using metasploit:

Scan for no-auth:

Meterpreter post exploitation module:

5985 - WinRM

This is the Windows Remote Management tool. It allows remote management, meaning that any server that has this service allows us to connect to it if you have credentials and permissions to use it.

Connect:

6379 - Redis

Enumerate:

Client:

Exploitation:

  1. We first telnet to the server and check whether a successful connection is possible or not:

  1. We then terminate the telnet session. Next, we generate our SSH key using the following command:

  1. Then, we enter the file where we want to save it:

  1. Our key is generated; now we need to write it on the server. To do that need to install redis-cli:

  1. Once it is installed, we go back to our generated key and add some random data before and after our key:

  1. Now we need to replace the keys in the database with ours. So we connect to the host using this:

  1. Next we flush the keys using the following command:

  1. Now we need to set our keys into the database. We do this using the following command::

  1. Once that's done, we need to copy the uploaded key into the .ssh folder; first, we check the current folder with this:

  1. Now we change our directory to /root/.ssh/:

  1. Next, we change the name of our file using config set dbfilename "authorized_keys" and save using save.

  2. Now we try to ssh into the machine:

8080 - Tomcat (one of the most common)

Tomcat suffers from default passwords. There is even a module in metasploit that enumerates common tomcat passwords. And another module for exploiting it and giving you a shell.

Tests whether a directory traversal vulnerability is present in versions of Apache Tomcat 4.1.0 - 4.1.37, 5.5.0 - 5.5.26 and 6.0.0 - 6.0.16 under specific and non-default installations:

Enumerating Apache Tomcat's usernames via malformed requests to j_security_check, which can be found in the web administration package. It should work against Tomcat servers 4.1.0 - 4.1.39, 5.5.0 - 5.5.27, and 6.0.0 - 6.0.18:

Login to a Tomcat Application Manager instance using a specific user/pass:

8080 - WebDav

Test:

11211 - Memcached

Enumerate:

Extract data with metasploit:

PreviousEnumerationNextVulnerability Analysis

Last updated

Was this helpful?