pwnwiki.github.io/references/ports.md

Networking Port Reference

TODO - Switch the NAME: and the PORT # so the port numbers go first.

TCP Discovery Ports:

• easy copy - 7,21,22,23,25,80,88,110,111,139,143,389,443,445,514,515,631,1352,2049,3000,3389,4949,5060,5631,5632,5666,5900-5905,6000-6009,8000,8006,8080,8089,8443,8834,9080,9100,9443,17500
• 7 Finger
• 21 FTP
• 22 SSH
• 23 Telnet
• 25 SMTP
• 80 HTTP
• 88 Kerberos
• 110 POP3
• 111 SUNRPC(UnixRPC)
• 139 NetBIOS
• 143 IMAP
• 389 LDAP
• 443 HTTPS
• 445 MicrosoftDS
• 514 RSH
• 515 Printers
• 631 CUPS
• 1352 LotusNotes
• 2049 NFS
• 3000 Webrick (Ruby Webserver)
• 3389 RDP
• 4949 Munin
• 5060 SIP
• 5631-5632 PCAnywhere
• 5666(evidence of Nagios server on network) NRPE(*nix)/NSCLIENT++(win)
• 5900-5906 (Same as X11; display over VNC. SPICE is usually in this range as well) VNC
• 6000-6009 (seexspy, xwd, xkeyforexploitation) X11
• 8006 Proxmox
• 8080 Alt-HTTP
• 8089(also on 8000) Splunk
• 8000(mezzanine in development mode for example) AnotherHTTP
• 8834 Nessus HTTPS
• 8443 AltHTTPS
• 9080 Alt-HTTPtomcat
• 9443 vSphere
• 9100 Printers
• 17500 Dropbox lansync

UDP Discovery:

• easy copy - 53,111,123,161,177,500,514,1194,1434,1900,17185
• 53 DNS
• 111 SUNRPC (Unix RPC)
• 123 Network Time Protocol (NTP)
• 161 SNMP
• 177 XDMCP (via NSE script --script broadcast-xdmcp-discover, discover *nix boxes hosting X)
• 500 Isakmp (ike PSK Attack)
• 514 syslog
• 1194 OpenVPN
• 1434 MSSQL Ping
• 1900 UPNP
• 17185 vxworks debug

Authentication Ports:

• easy copy - 80,902,1494,5985,5986,6129,8200,9084
• Citrix: 1494
• WinRM: 80, 5985 (HTTP), 5986 (HTTPS)
• VMware Server: 8200, 902, 9084
• DameWare: 6129

Easy-win Ports:

• Java RMI - 1099, 1098
• coldfusion default stand alone - 8500
• IPMI UDP(623) (easy crack or auth bypass)
• 6002, 7002 (sentinel license monitor (reverse dir traversal, sometimes as SYSTEM))
• GlassFish: 4848
• easy copy - 9060
• IBM Web Sphere: 9060
• Webmin or BackupExec: 10000
• memcached: 11211
• DistCC: 3632
• SAP Router: 3299

Database Ports:

• easy copy - 3306,1521-1527,5432,5433,1433,3050,3351,1583,8471,9471
• MySQL: 3306
• PostgreSQL: 5432
• PostgreSQL 9.2: 5433
• Oracle TNS Listener: 1521-1527
• Oracle XDB: 2100
• MSSQL: 1433
• Firebird / Interbase: 3050
• PervasiveSQL: 3351, 1583
• DB2/AS400 8471, 9471
• Sybase 5000

SCADA / ICS:##

(source: http://www.digitalbond.com/tools/the-rack/control-system-port-list/ )

• BACnet/IP: UDP/47808
• DNP3: TCP/20000, UDP/20000
• EtherCAT: UDP/34980
• Ethernet/IP: TCP/44818, UDP/2222, UDP/44818
• FL-net: UDP/55000 to 55003
• Foundation Fieldbus HSETCP/1089 to 1091, UDP/1089 to 1091
• ICCP: TCP/102
• Modbus TCP: TCP/502
• OPC UA Binary: Vendor Application Specific
• OPC UA Discovery Server: TCP/4840
• OPC UA XML: TCP/80, TCP/443
• PROFINET: TCP/34962 to 34964, UDP/34962 to 34964
• ROC PLus: TCP/UDP 4000

Interesting Port Ranges:

• HTTP(S) Ports: 8000-9000

Web easy-win URLs:

(moved to: https://etherpad.mozilla.org/weburl-easywins ) awk '$2~/tcp$/' nmap-services | sort -r -k3 | head -n 1000 # same for udp