> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/ports-and-services.md). # Ports and Services Port and service enumeration notes for penetration testing, including FTP, SSH, SMB, Kerberos, LDAP, SNMP, WinRM, RDP, databases, C2 panels, and exposed management services. Practical service enumeration and exploitation notes for penetration testing and CTF workflows. Use this section to move from open ports to verified attack paths: anonymous access, weak credentials, exposed files, default configurations, known CVEs, remote command execution, and lateral movement. ## Service Enumeration Workflow 1. Identify open ports, protocol versions, and exposed products. 2. Check anonymous access, default credentials, weak authentication, and management panels. 3. Enumerate service-specific data: shares, users, banners, tickets, databases, OIDs, mailboxes, or directory objects. 4. Validate known CVEs, dangerous features, credential reuse, and misconfigurations. 5. Convert findings into a clean attack path: file read, credential discovery, remote command execution, reverse shell, privilege escalation, or lateral movement. ## High-Value Checks * **Identity services:** Kerberos, LDAP, SMB, WinRM, and RDP often expose users, tickets, hashes, and administrative paths. * **File and data services:** FTP, SMB, NFS, MongoDB, MSSQL, Elasticsearch, and InfluxDB commonly reveal credentials or sensitive files. * **Remote execution surfaces:** distcc, gdbserver, Consul, C2 panels, MSSQL `xp_cmdshell`, and vulnerable SMB services can lead directly to code execution. * **Remote access services:** SSH, RDP, VNC, and WinRM are useful for credential validation, tunneling, and lateral movement. ## Service Notes ## Recommended Tools * [Nmap](/reconnaissance/nmap.md) for port scanning, service detection, and NSE scripts. * CrackMapExec, NetExec, Impacket, and rpcclient for SMB, LDAP, Kerberos, WinRM, and MSSQL checks. * Hydra, Kerbrute, and service-specific clients for controlled credential validation. * Gobuster, ffuf, Nikto, and Burp Suite for HTTP and HTTPS service discovery. * snmpwalk, ldapsearch, smbclient, enum4linux-ng, and showmount for protocol-specific enumeration.

:folder-open:

FTP - 21FTP enumeration notes for anonymous access, brute force checks, file upload abuse, web shells, and reverse shells.FTP - 21

:terminal:

SSH - 22SSH enumeration notes for brute force testing, user enumeration, key-based access, and credential validation.SSH - 22

:globe:

HTTP & HTTPS - 80/443HTTP and HTTPS service notes for TLS inspection, certificate review, Heartbleed checks, and web-facing attack surface validation.HTTP & HTTPS - 80/443

:ticket:

Kerberos - 88Kerberos enumeration notes for AS-REP roasting, Kerberoasting, user discovery, and Active Directory authentication attacks.Kerberos - 88

:circle-nodes:

SNMP - 161SNMP enumeration notes for community strings, OID walking, information disclosure, credentials, and scheduled task leaks.SNMP - 161

:folder-tree:

LDAP - 389/636/3268/3269LDAP enumeration notes for naming contexts, Active Directory objects, users, groups, authenticated binds, and sensitive attributes.LDAP - 389/636/3268/3269

:network-wired:

SMB - 445SMB enumeration and exploitation notes for shares, null sessions, RID brute force, PsExec, NetExec, CrackMapExec, SMBMap, and EternalBlue.SMB - 445

:lock:

IKE/IPsec - 500IKE/IPsec aggressive mode enumeration with ike-scan, PSK hash capture, hashcat cracking, and SSH access.IKE/IPsec - 500

:bug:

gdbserver - 1337gdbserver exploitation with Searchsploit, msfvenom payload generation, and reverse shell execution.gdbserver - 1337

:database:

MSSQL - 1433MSSQL exploitation notes for credential testing, mssqlclient access, xp_cmdshell, PowerShell payload delivery, and reverse shells.MSSQL - 1433

:share-nodes:

NFS - 2049NFS enumeration notes for exported shares, mount permissions, readable backups, configuration files, and credential discovery.NFS - 2049

:gears:

distcc - 3632distcc CVE-2004-2687 validation and remote command execution with Nmap, Python exploit code, and reverse shells.distcc - 3632

:desktop:

RDP - 3389RDP notes for brute force checks, credential validation, BlueKeep detection, and remote desktop access during penetration tests.RDP - 3389

:envelope:

James Server - 4555/119/110Apache James enumeration across NNTP, remote administration, POP3 mailbox access, password reset abuse, and credential discovery.James Server - 4555/119/110

:desktop:

VNC - 5800,5801,5900,5901VNC port forwarding through SSH, VNC service scanning, vncviewer access, and root session validation.VNC - 5800,5801,5900,5901

:windows:

WinRM - 5986WinRM notes for Evil-WinRM access, brute force testing, Pass-the-Hash, certificate authentication, and remote PowerShell administration.WinRM - 5986

:helmet-safety:

HardHatC2 - 7096HardHatC2 authentication bypass, forged JWT generation, TeamLead user creation, and implant reverse shell execution.HardHatC2 - 7096

:globe:

InfluxDB - 8086InfluxDB CVE-2019-20933 authentication bypass, database enumeration, and credential discovery.InfluxDB - 8086

:globe:

Devzat - 8443Devzat file parameter abuse, backup discovery, path traversal, shadow file read, and root SSH key access.Devzat - 8443

:server:

Consul - 8500Consul REST API exposure and malicious service check registration for reverse shell execution.Consul - 8500

:chart-simple:

Elasticsearch - 9200Elasticsearch index enumeration, data exposure review, keyword filtering, and base64 credential recovery.Elasticsearch - 9200

:database:

MongoDB - 27017MongoDB unauthenticated access, database enumeration, command injection through app.js, and reverse shell execution.MongoDB - 27017

:helmet-safety:

Havoc-C2 - 40056Havoc-C2 SSRF to RCE workflow with hosted payload delivery and reverse shell access.Havoc-C2 - 40056
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/ports-and-services.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.