Network Ports Reference

Network Ports Reference

Purpose

Provide quick reference for TCP/UDP port numbers and their associated protocols during reconnaissance, enumeration, and security assessments. Enable rapid identification of services running on target systems and support port-based attack surface mapping.

Inputs/Prerequisites

• Target IP address or hostname for port scanning
• Network access to the target system
• Port scanning tools (nmap, masscan, netcat)
• Basic understanding of TCP/IP networking

Outputs/Deliverables

• Identified open ports and associated services
• Protocol-specific enumeration data
• Service version information
• Attack surface documentation
• Port-to-vulnerability mapping

Core Workflow

1. Identify Common Service Ports

Reference these critical ports during reconnaissance:

2. Perform Port Discovery

Scan for open ports on target systems:

# Quick TCP SYN scan of common ports
nmap -sS -T4 192.168.1.1

# Comprehensive port scan (all 65535 ports)
nmap -p- -sS -T4 192.168.1.1

# UDP port scan
nmap -sU -T4 --top-ports 100 192.168.1.1

# Service version detection
nmap -sV -sC 192.168.1.1

# Fast scan with masscan
masscan -p1-65535 192.168.1.0/24 --rate=1000

# Check specific port with netcat
nc -zv 192.168.1.1 22

3. Enumerate Services by Port

Perform targeted enumeration based on discovered ports:

# FTP (21) - Check anonymous access
ftp 192.168.1.1
nmap --script ftp-anon 192.168.1.1

# SSH (22) - Grab banner and check versions
ssh -v 192.168.1.1
nmap --script ssh-hostkey 192.168.1.1

# SMTP (25) - Enumerate users
nmap --script smtp-enum-users 192.168.1.1

# DNS (53) - Zone transfer
dig axfr @192.168.1.1 domain.com

# HTTP (80/443) - Web enumeration
nikto -h http://192.168.1.1
gobuster dir -u http://192.168.1.1 -w /usr/share/wordlists/dirb/common.txt

# SMB (445) - Share enumeration
smbclient -L //192.168.1.1 -N
enum4linux -a 192.168.1.1

# SNMP (161) - Community string discovery
snmpwalk -c public -v1 192.168.1.1
onesixtyone 192.168.1.1 public

# LDAP (389) - Query directory
ldapsearch -x -h 192.168.1.1 -s base

# MySQL (3306) - Database enumeration
nmap --script mysql-enum 192.168.1.1

4. Map Attack Surface

Document findings for exploitation:

# Generate port scan report
nmap -sV -sC -oA scan_results 192.168.1.1

# Create service inventory
nmap -sV 192.168.1.1 -oG - | grep open

Quick Reference

High-Value Target Ports

Database Ports

Remote Access Ports

Constraints

• Always verify port assignments as services can run on non-standard ports
• Some ports are registered but rarely used in practice
• Firewalls may filter or redirect traffic
• NAT and port forwarding can obscure actual service locations
• Service banners can be spoofed for deception

Examples

Example 1: Quick Web Server Identification

# Scan common web ports
nmap -p 80,443,8080,8443 192.168.1.0/24

# Get HTTP headers
curl -I http://192.168.1.1

Example 2: Database Discovery

# Scan for common database ports
nmap -p 1433,1521,3306,5432,27017 192.168.1.0/24 -sV

# Test MySQL connection
mysql -h 192.168.1.1 -u root -p

Example 3: Full Port Audit

# Comprehensive scan with service detection
nmap -p- -sV -sC -A 192.168.1.1 -oA full_audit

Troubleshooting