Common Ports Reference

Plaintext credentials and data. Replace with SFTP/FTPS.

Key-based auth only, no root login, rate-limit brute force.

Fully unencrypted remote shell. Should never be exposed.

Mail relay; check for open relay and enforce TLS.

Watch for recursion abuse, amplification and tunnelling.

Rogue DHCP servers enable man-in-the-middle attacks.

No authentication. Common config-theft target.

Redirect to HTTPS and enable HSTS.

Legacy mail retrieval; prefer POP3S/IMAPS.

Amplification vector when left open to the internet.

Windows RPC endpoint mapper. Block at the perimeter.

Legacy Windows naming/sharing. Internal only.

Plaintext mail access unless wrapped in TLS.

Default community strings leak device inventory.

Directory queries in cleartext; use LDAPS (636).

Check TLS version, ciphers and certificate expiry.

Ransomware and lateral-movement favourite. Never expose.

Authenticated mail submission over TLS.

Log forwarding; unencrypted by default.

LDAP over TLS. Verify certificate chain.

Frequently exposed with anonymous read access.

Encrypted IMAP. Preferred over 143.

Encrypted POP3.

Database port; keep private and patched.

Listener enumeration is a classic recon step.

Export lists often over-permissive.

Bind to localhost; never expose publicly.

Top ransomware entry point. Put behind VPN + MFA.

VoIP signalling; toll-fraud target.

Restrict with pg_hba.conf and network rules.

Weak legacy auth; often exposed without a password.

Remote PowerShell; heavily abused for lateral movement.

No auth by default. Trivial remote takeover if exposed.

Admin panels and proxies hide here. Enumerate them.

Classic source of open-data leaks.

Massive UDP amplification vector.

Historically unauthenticated; audit exposure.