khanfarris

  • ports
    • 20 — FTP (Data)
      FTP (Data) - Port 20
      Protocol: TCP
      Usage: File Transfer Protocol data channel
      Security: Unencrypted, vulnerable to MITM attacks
      Watch for: Suspicious file transfers, privilege escalation attempts
    • 21 — FTP (Control)
      FTP (Control) - Port 21
      Protocol: TCP
      Usage: File Transfer Protocol control commands
      Security: Unencrypted authentication, weak protocols
      Watch for: Brute force attacks, anonymous login attempts
    • 22 — SSH
      SSH - Port 22
      Protocol: TCP
      Usage: Secure Shell remote administration
      Security: Encrypted, strong authentication
      Watch for: Brute force attacks, unusual login times/locations
    • 23 — Telnet
      Telnet - Port 23
      Protocol: TCP
      Usage: Unencrypted remote terminal access
      Security: Unencrypted, credentials exposed
      Watch for: Any usage (should be replaced with SSH), password sniffing
    • 25 — SMTP
      SMTP - Port 25
      Protocol: TCP
      Usage: Mail server communication
      Security: Unencrypted by default
      Watch for: Spam, phishing emails, relay attacks, DDoS amplification
    • 53 — DNS
      DNS - Port 53
      Protocol: TCP/UDP
      Usage: Domain name resolution
      Security: Unencrypted by default (DNS over HTTPS/TLS available)
      Watch for: DNS tunneling, DDoS amplification, cache poisoning
    • 80 — HTTP
      HTTP - Port 80
      Protocol: TCP
      Usage: Web browsing, HTTP traffic
      Security: Unencrypted, credentials in plaintext
      Watch for: Credential harvesting, sensitive data exposure, malware downloads
    • 88 — Kerberos
      Kerberos - Port 88
      Protocol: TCP/UDP
      Usage: Network authentication protocol
      Security: Encrypted tickets, time-bound authentication
      Watch for: Golden ticket attacks, ticket replay attacks, time skew attacks
    • 110 — POP3
      POP3 - Port 110
      Protocol: TCP
      Usage: Email retrieval from mail server
      Security: Unencrypted authentication and data
      Watch for: Credential theft, email interception, brute force attacks
    • 111 — RPCbind
      RPCbind - Port 111
      Protocol: TCP/UDP
      Usage: Maps RPC program numbers to ports
      Security: Vulnerable, often exposed
      Watch for: Enumeration attempts, unauthorized service discovery, RPC exploits
    • 135 — MSRPC
      MSRPC - Port 135
      Protocol: TCP
      Usage: Microsoft RPC endpoint mapper
      Security: Vulnerable to enumeration and exploitation
      Watch for: EternalBlue, DCE/RPC exploits, unauthorized enumeration
    • 139 — NetBIOS-SSN
      NetBIOS-SSN - Port 139
      Protocol: TCP
      Usage: NetBIOS session service, legacy Windows file sharing
      Security: Unencrypted, NTLM authentication
      Watch for: Pass-the-hash, NTLM relay, SMB exploits
    • 143 — IMAP
      IMAP - Port 143
      Protocol: TCP
      Usage: Email access protocol
      Security: Unencrypted authentication and mail content
      Watch for: Credential theft, email interception, unauthorized access
    • 161 — SNMP
      SNMP - Port 161
      Protocol: UDP
      Usage: Network device monitoring and management
      Security: Weak community strings, information disclosure
      Watch for: Default community strings, network reconnaissance, OID brute force
    • 389 — LDAP
      LDAP - Port 389
      Protocol: TCP/UDP
      Usage: Directory services authentication
      Security: Unencrypted by default, bind attacks
      Watch for: Null bind attacks, LDAP injection, credential harvesting
    • 443 — HTTPS
      HTTPS - Port 443
      Protocol: TCP
      Usage: Encrypted web traffic
      Security: TLS/SSL encrypted
      Watch for: TLS downgrade attacks, weak ciphers, certificate issues, malware C2
    • 445 — SMB
      SMB - Port 445
      Protocol: TCP
      Usage: Windows file sharing, print services
      Security: Often exploits, EternalBlue, pass-the-hash
      Watch for: Lateral movement, ransomware propagation, Null sessions, Kerberoasting
    • 636 — LDAPS
      LDAPS - Port 636
      Protocol: TCP
      Usage: Secure LDAP over SSL/TLS
      Security: Encrypted LDAP
      Watch for: Weak SSL/TLS, certificate issues, LDAP injection
    • 993 — IMAPS
      IMAPS - Port 993
      Protocol: TCP
      Usage: Secure IMAP over SSL/TLS
      Security: Encrypted email access
      Watch for: Certificate issues, weak ciphers, brute force attacks
    • 995 — POP3S
      POP3S - Port 995
      Protocol: TCP
      Usage: Secure POP3 over SSL/TLS
      Security: Encrypted email retrieval
      Watch for: Certificate issues, weak ciphers, brute force attacks
    • 1433 — MSSQL
      MSSQL - Port 1433
      Protocol: TCP
      Usage: Microsoft SQL Server
      Security: SQL injection vulnerabilities
      Watch for: SQL injection, brute force, unauthorized access, data exfiltration
    • 3306 — MySQL
      MySQL - Port 3306
      Protocol: TCP
      Usage: MySQL database server
      Security: Weak authentication, SQL injection
      Watch for: SQL injection, brute force, privilege escalation, data exfiltration
    • 3389 — RDP
      RDP - Port 3389
      Protocol: TCP
      Usage: Remote Desktop Protocol
      Security: Targeted by ransomware, brute force attacks
      Watch for: Brute force, BlueKeep exploits, unauthorized access, lateral movement
    • 5432 — PostgreSQL
      PostgreSQL - Port 5432
      Protocol: TCP
      Usage: PostgreSQL database server
      Security: SQL injection, weak auth
      Watch for: SQL injection, brute force, unauthorized database access
    • 5985 — WinRM HTTP
      WinRM HTTP - Port 5985
      Protocol: TCP
      Usage: Windows Remote Management
      Security: Unencrypted by default
      Watch for: Credential theft, pass-the-hash, lateral movement
    • 5986 — WinRM HTTPS
      WinRM HTTPS - Port 5986
      Protocol: TCP
      Usage: Windows Remote Management encrypted
      Security: TLS/SSL encrypted
      Watch for: Certificate issues, pass-the-hash, lateral movement
    • 8080 — HTTP-Proxy
      HTTP-Proxy - Port 8080
      Protocol: TCP
      Usage: Alternative HTTP port, proxies
      Security: Often misconfigured, unencrypted
      Watch for: Open proxies, malware C2, unauthorized access
    • 8443 — HTTPS-Proxy
      HTTPS-Proxy - Port 8443
      Protocol: TCP
      Usage: Alternative HTTPS port, secure proxies
      Security: TLS/SSL encrypted
      Watch for: Certificate issues, malware C2, unauthorized proxy use
© khanfarris
Notes
Enter Password to Save Notes
Incorrect password. Please try again.