Understanding popular ports and their associated services is crucial for network security assessment. This lesson covers the most commonly encountered ports, their services, typical vulnerabilities, and specific NMAP commands for effective reconnaissance.
Learn common vulnerabilities and security considerations for each service.
Targeted scanning techniques and NSE scripts for each service.
Understanding how these services are used in actual network environments.
Used for transferring files between client and server
FTP transmits credentials in cleartext. Consider SFTP or FTPS for secure file transfers.
nmap -p 21 -sV targetnmap -p 21 --script ftp-anon targetnmap -p 21 --script ftp-bounce targetSecure remote login and command execution
Use key-based authentication, disable root login, and keep SSH updated.
nmap -p 22 -sV targetnmap -p 22 --script ssh-auth-methods targetnmap -p 22 --script ssh-hostkey targetUnencrypted remote terminal access
Telnet should be replaced with SSH in all modern environments.
nmap -p 23 -sV targetnmap -p 23 --script telnet-ntlm-info targetnmap -p 23 --script banner targetEmail transmission between servers
Configure proper authentication and disable open relay functionality.
nmap -p 25 -sV targetnmap -p 25 --script smtp-enum-users targetnmap -p 25 --script smtp-open-relay targetDomain name resolution services
Restrict zone transfers and implement DNS security extensions (DNSSEC).
nmap -p 53 -sU -sV targetnmap -p 53 --script dns-zone-transfer targetnmap -p 53 --script dns-cache-snoop targetUnencrypted web traffic
Use HTTPS (port 443) for sensitive data transmission.
nmap -p 80 -sV targetnmap -p 80 --script http-title targetnmap -p 80 --script http-enum targetEmail retrieval from server to client
Use POP3S (port 995) or IMAP with SSL/TLS encryption.
nmap -p 110 -sV targetnmap -p 110 --script pop3-capabilities targetnmap -p 110 --script pop3-brute targetMicrosoft RPC endpoint resolution
Block this port at the firewall unless required for legitimate RPC services.
nmap -p 135 -sV targetnmap -p 135 --script rpc-grind targetnmap -p 135 --script msrpc-enum targetWindows file and printer sharing
Disable NetBIOS or use SMB3 with encryption for modern networks.
nmap -p 139 -sV targetnmap -p 139 --script smb-enum-shares targetnmap -p 139 --script smb-os-discovery targetEmail access and synchronization
Use IMAPS (port 993) with SSL/TLS encryption for secure email access.
nmap -p 143 -sV targetnmap -p 143 --script imap-capabilities targetnmap -p 143 --script imap-brute targetEncrypted web traffic using SSL/TLS
Use strong cipher suites, valid certificates, and latest TLS versions.
nmap -p 443 -sV targetnmap -p 443 --script ssl-enum-ciphers targetnmap -p 443 --script ssl-cert targetModern Windows file sharing protocol
Keep Windows updated and use SMB3 with encryption enabled.
nmap -p 445 -sV targetnmap -p 445 --script smb-vuln-ms17-010 targetnmap -p 445 --script smb-enum-shares targetSecure email access with encryption
Ensure strong SSL/TLS configuration and certificate validation.
nmap -p 993 -sV targetnmap -p 993 --script ssl-enum-ciphers targetnmap -p 993 --script imap-capabilities targetSecure email retrieval with encryption
Use strong SSL/TLS settings and consider migrating to IMAP.
nmap -p 995 -sV targetnmap -p 995 --script ssl-enum-ciphers targetnmap -p 995 --script pop3-capabilities targetMicrosoft SQL Server database service
Use strong authentication, disable sa account, and implement network segmentation.
nmap -p 1433 -sV targetnmap -p 1433 --script ms-sql-info targetnmap -p 1433 --script ms-sql-empty-password targetMySQL database server
Use strong passwords, disable remote root access, and implement proper access controls.
nmap -p 3306 -sV targetnmap -p 3306 --script mysql-info targetnmap -p 3306 --script mysql-empty-password targetWindows remote desktop access
Use Network Level Authentication, strong passwords, and VPN access.
nmap -p 3389 -sV targetnmap -p 3389 --script rdp-enum-encryption targetnmap -p 3389 --script rdp-vuln-ms12-020 targetPostgreSQL database server
Configure proper authentication, use SSL connections, and limit network access.
nmap -p 5432 -sV targetnmap -p 5432 --script pgsql-brute targetnmap -p 5432 --script banner targetnmap -p 21,22,23,25,53,80,110,443 targetScan common ports quickly
nmap --top-ports 1000 targetScan top 1000 most common ports
nmap -sV -sC targetVersion detection with default scripts
nmap -A targetAggressive scan (OS, version, scripts, traceroute)