Posts tagged: #ports

Ports tied to trojans, backdoors and C2 — NetBus, Back Orifice, ingreslock, Meterpreter and abused legit services — and how to detect a compromise.

A scannable reference of common TCP and UDP ports grouped by purpose — web, mail, file transfer, remote access, databases, and infrastructure.

Check open and listening ports on Windows, Linux, and macOS, map a PID to its process, and scan a remote host with Nmap. Commands you can copy-paste.

Learn how to close a port the right way: stop the service vs firewall it. Covers Windows Firewall, ufw, firewalld, iptables, and disabling services safely.

Learn how to scan TCP and UDP ports with Nmap: install, port selection, SYN vs connect scans, version detection, NSE scripts, and output formats.

The internet-facing ports attackers hit first — RDP, SSH, SMB, databases — and the single most important hardening step for each.

A practical guide to ports you should never expose to the internet — SMB, RDP, Telnet, databases and more — with the risk and a safer alternative for each.

A clear comparison of TCP and UDP: handshakes, reliability, headers, real-world use cases, and why UDP fuels amplification DDoS attacks.

How reflection and amplification DDoS attacks abuse UDP services like DNS, NTP, SNMP, SSDP and Memcached — with amplification factors and how to avoid being a reflector.

Understand the IANA port ranges: well-known (0-1023), registered (1024-49151), and dynamic (49152-65535), plus how the 16-bit port space and ephemeral ports work.

The full list of ports a domain controller needs — Kerberos, LDAP, SMB, RPC, Global Catalog — plus why none of them should ever face the internet.

DNS uses port 53 over both UDP and TCP, with DNS-over-TLS on 853, mDNS on 5353 and LLMNR on 5355. Learn why, plus DNS attacks and how to encrypt lookups.

A complete guide to email ports: SMTP 25, submission 587, SMTPS 465, POP3 110/995, IMAP 143/993 — when to use each and how to secure them with TLS.

FTP uses port 21 for control and port 20 for data, with FTPS on 990. Learn active vs passive mode, why SFTP is really SSH on port 22, and what to use.

SMB and CIFS use port 445 today, with legacy NetBIOS on 137 and 139. Here is what each does, why 445 is the top ransomware vector, and what to block.