Ports
Oct 18, 2026 · Reference
Goal
Know these without looking them up. Format: port (protocol, what it does).
Related: Acronyms · TCP and UDP
Covered so far
| Port | Protocol | TCP/UDP | What it does | Why pentesters care |
|---|---|---|---|---|
| 21 | FTP (File Transfer Protocol) | TCP | File transfers | Often allows anonymous login, sends passwords in plain text |
| 22 | SSH (Secure Shell) | TCP | Encrypted remote terminal | Login target, brute force, stolen keys |
| 23 | Telnet | TCP | Unencrypted remote terminal | Everything, passwords included, in plain text |
| 25 | SMTP (Simple Mail Transfer Protocol) | TCP | Sending email | User enumeration, open relays |
| 53 | DNS (Domain Name System) | UDP (and TCP) | Names > IPs | Recon, zone transfers leak every hostname |
| 67/68 | DHCP (Dynamic Host Configuration Protocol) | UDP | Hands out IPs (67 server, 68 client) | Rogue DHCP, starvation |
| 69 | TFTP (Trivial File Transfer Protocol) | UDP | File transfer with no login | Grab config files with no password |
| 80 | HTTP (Hypertext Transfer Protocol) | TCP | Unencrypted web | Web app attacks, traffic is readable |
| 110 | POP3 (Post Office Protocol v3) | TCP | Downloading email | Plain text logins |
| 135 | RPC (Remote Procedure Call) | TCP | Windows services talking to each other | Windows enumeration |
| 139 | NetBIOS (Network Basic Input/Output System) | TCP | Old Windows file sharing | Enumeration, works with SMB |
| 143 | IMAP (Internet Message Access Protocol) | TCP | Reading email on the server | Plain text logins |
| 161 | SNMP (Simple Network Management Protocol) | UDP | Device monitoring | Default "public" community string leaks device info |
| 443 | HTTPS (HTTP Secure) | TCP (and UDP for QUIC) | Encrypted web | Web app attacks, SNI (Server Name Indication) shows site names |
| 445 | SMB (Server Message Block) | TCP | Windows file sharing | Top target: shares, relay attacks, EternalBlue |
| 3389 | RDP (Remote Desktop Protocol) | TCP | Windows remote desktop | Login target, brute force |
Coming up in PEH (Practical Ethical Hacking)
| Port | Protocol | TCP/UDP | What it does | Why pentesters care |
|---|---|---|---|---|
| 88 | Kerberos | TCP/UDP | AD (Active Directory) login tickets | Kerberoasting, AS-REP roasting |
| 123 | NTP (Network Time Protocol) | UDP | Clock sync | Kerberos breaks if clocks are off |
| 389 | LDAP (Lightweight Directory Access Protocol) | TCP | Querying AD (Active Directory) | Dump users, groups, computers |
| 636 | LDAPS (LDAP Secure) | TCP | Encrypted LDAP | Same as 389, encrypted |
| 1433 | MSSQL (Microsoft SQL Server) | TCP | Microsoft database | Default creds, command execution |
| 3306 | MySQL | TCP | MySQL database | Default creds, data theft |
| 5985/5986 | WinRM (Windows Remote Management) | TCP | Remote PowerShell (5985 HTTP, 5986 HTTPS) | Remote shell with valid creds (evil-winrm) |
| 8080 | HTTP alternate | TCP | Web servers, admin panels, proxies | Often forgotten dev or admin sites |
Quick memory groups
- Remote access: 22 (SSH (Secure Shell)), 23 (Telnet), 3389 (RDP (Remote Desktop Protocol)), 5985 (WinRM (Windows Remote Management))
- Web: 80 (HTTP (Hypertext Transfer Protocol)), 443 (HTTPS (HTTP Secure)), 8080 (HTTP alternate)
- File transfer: 21 (FTP (File Transfer Protocol)), 69 (TFTP (Trivial File Transfer Protocol)), 445 (SMB (Server Message Block))
- Email: 25 (SMTP (Simple Mail Transfer Protocol), send), 110 (POP3 (Post Office Protocol v3), download), 143 (IMAP (Internet Message Access Protocol), read on server)
- Windows / AD (Active Directory): 88 (Kerberos), 135 (RPC (Remote Procedure Call)), 139 (NetBIOS), 389 (LDAP (Lightweight Directory Access Protocol)), 445 (SMB)
- Network plumbing (mostly UDP (User Datagram Protocol)): 53 (DNS (Domain Name System)), 67/68 (DHCP (Dynamic Host Configuration Protocol)), 123 (NTP (Network Time Protocol)), 161 (SNMP (Simple Network Management Protocol))
Port ranges
- 0 to 1023: well-known ports (the ones above)
- 1024 to 49151: registered ports (apps like 3306 MySQL, 3389 RDP)
- 49152 to 65535: ephemeral ports, picked randomly as the source port for outgoing connections (like
50074in my Wikipedia capture)