network-ports-reference

# Network Ports Reference ## Purpose Provide quick reference for TCP/UDP port numbers and their associated protocols during reconnaissance, enumeration, and security assessments. Enable rapid identification of services running on target systems and support port-based attack surface mapping. ## Inputs/Prerequisites - Target IP address or hostname for port scanning - Network access to the target system - Port scanning tools (nmap, masscan, netcat) - Basic understanding of TCP/IP networking ## Outputs/Deliverables - Identified open ports and associated services - Protocol-specific enumeration data - Service version information - Attack surface documentation - Port-to-vulnerability mapping ## Core Workflow ### 1. Identify Common Service Ports Reference these critical ports during reconnaissance: | Port | Protocol | Service | |------|----------|---------| | 20 | TCP | FTP Data Transfer | | 21 | TCP | FTP Control | | 22 | TCP | SSH | | 23 | TCP | Telnet | | 25 | TCP | SMTP | | 53 | TCP/UDP | DNS | | 67-68 | UDP | DHCP | | 69 | UDP | TFTP | | 80 | TCP | HTTP | | 88 | TCP | Kerberos | | 110 | TCP | POP3 | | 111 | TCP/UDP | RPC Portmapper | | 119 | TCP | NNTP | | 123 | UDP | NTP | | 135 | TCP | MS RPC | | 137-139 | TCP/UDP | NetBIOS | | 143 | TCP | IMAP | | 161-162 | UDP | SNMP | | 389 | TCP | LDAP | | 443 | TCP | HTTPS | | 445 | TCP | SMB/CIFS | | 465 | TCP | SMTPS | | 500 | UDP | IKE/IPSec | | 514 | UDP | Syslog | | 587 | TCP | SMTP Submission | | 636 | TCP | LDAPS | | 993 | TCP | IMAPS | | 995 | TCP | POP3S | | 1433 | TCP | MS SQL | | 1521 | TCP | Oracle DB | | 2049 | TCP | NFS | | 3306 | TCP | MySQL | | 3389 | TCP | RDP | | 5432 | TCP | PostgreSQL | | 5900 | TCP | VNC | | 6379 | TCP | Redis | | 8080 | TCP | HTTP Proxy | | 8443 | TCP | HTTPS Alt | ### 2. Perform Port Discovery Scan for open ports on target systems: ```bash # Quick TCP SYN scan of common ports nmap -sS -T4 192.168.1.1 # Comprehensive port scan (all 65535 ports) nmap -p- -sS -T4 192.168.1.1 # UDP port scan nmap -sU -T4 --top-ports 100 192.168.1.1 # Service version detection nmap -sV -sC 192.168.1.1 # Fast scan with masscan masscan -p1-65535 192.168.1.0/24 --rate=1000 # Check specific port with netcat nc -zv 192.168.1.1 22 ``` ### 3. Enumerate Services by Port Perform targeted enumeration based on discovered ports: ```bash # FTP (21) - Check anonymous access ftp 192.168.1.1 nmap --script ftp-anon 192.168.1.1 # SSH (22) - Grab banner and check versions ssh -v 192.168.1.1 nmap --script ssh-hostkey 192.168.1.1 # SMTP (25) - Enumerate users nmap --script smtp-enum-users 192.168.1.1 # DNS (53) - Zone transfer dig axfr @192.168.1.1 domain.com # HTTP (80/443) - Web enumeration nikto -h http://192.168.1.1 gobuster dir -u http://192.168.1.1 -w /usr/share/wordlists/dirb/common.txt # SMB (445) - Share enumeration smbclient -L //192.168.1.1 -N enum4linux -a 192.168.1.1 # SNMP (161) - Community string discovery snmpwalk -c public -v1 192.168.1.1 onesixtyone 192.168.1.1 public # LDAP (389) - Query directory ldapsearch -x -h 192.168.1.1 -s base # MySQL (3306) - Database enumeration nmap --script mysql-enum 192.168.1.1 ``` ### 4. Map Attack Surface Document findings for exploitation: ```bash # Generate port scan report nmap -sV -sC -oA scan_results 192.168.1.1 # Create service inventory nmap -sV 192.168.1.1 -oG - | grep open ``` ## Quick Reference ### High-Value Target Ports | Port | Why It Matters | |------|----------------| | 21 | Anonymous FTP access, file upload | | 22 | SSH brute force, key-based auth bypass | | 23 | Telnet cleartext credentials | | 25 | Mail relay, user enumeration | | 53 | DNS zone transfer, cache poisoning | | 80/443 | Web vulnerabilities (SQLi, XSS, RCE) | | 135/445 | SMB exploits (EternalBlue) | | 139 | NetBIOS enumeration | | 161 | SNMP default communities | | 389/636 | LDAP injection, AD enumeration | | 1433/3306 | Database access, SQL injection | | 3389 | RDP brute force, BlueKeep | | 5985/5986 | WinRM remote execution | | 6379 | Redis unauthenticated access | ### Database Ports | Port | Database | |------|----------| | 1433 | Microsoft SQL Server | | 1521 | Oracle | | 3306 | MySQL/MariaDB | | 5432 | PostgreSQL | | 5984 | CouchDB | | 6379 | Redis | | 27017 | MongoDB | ### Remote Access Ports | Port | Service | |------|---------| | 22 | SSH | | 23 | Telnet | | 3389 | RDP | | 5900 | VNC | | 5985/5986 | WinRM | ## Constraints - Always verify port assignments as services can run on non-standard ports - Some ports are registered but rarely used in practice - Firewalls may filter or redirect traffic - NAT and port forwarding can obscure actual service locations - Service banners can be spoofed for deception ## Examples ### Example 1: Quick Web Server Identification ```bash # Scan common web ports nmap -p 80,443,8080,8443 192.168.1.0/24 # Get HTTP headers curl -I http://192.168.1.1 ``` ### Example 2: Database Discovery ```bash # Scan for common database ports nmap -p 1433,1521,3306,5432,27017 192.168.1.0/24 -sV # Test MySQL connection mysql -h 192.168.1.1 -u root -p ``` ### Example 3: Full Port Audit ```bash # Comprehensive scan with service detection nmap -p- -sV -sC -A 192.168.1.1 -oA full_audit ``` ## Troubleshooting | Issue | Solution | |-------|----------| | Ports appear filtered | Try different scan techniques (-sA, -sW) | | Service detection fails | Use more aggressive version probing (-sV --version-all) | | UDP scan too slow | Reduce port range or increase timing (-T5) | | False positives | Verify with manual connection (nc, telnet) | | Firewall blocking scans | Use fragmentation (-f) or decoys (-D) | | Service on non-standard port | Always perform full port scans (-p-) |