Port reference
Port 88 (TCP/UDP) – Kerberos
Kerberos authentication — the ticket-granting protocol at the heart of Active Directory.
Default state
Open on every Active Directory domain controller. Should never be exposed to the internet.
Common attacks
- Kerberoasting of service account tickets
- AS-REP roasting of accounts without pre-authentication
- Golden and silver ticket forgery
- Pass-the-ticket and overpass-the-hash
Hardening
- Use long, random passwords for service accounts (gMSA where possible)
- Require Kerberos pre-authentication on all accounts
- Rotate the krbtgt account password regularly (twice)
- Monitor for anomalous TGS requests and encryption downgrades (RC4)
- Never expose 88 to the internet — keep DCs internal
nmap snippet
nmap -p88 --script krb5-enum-users <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 88?
Port 88 is the default for Kerberos, the network authentication protocol that underpins Active Directory. Every domain controller listens here to handle Authentication Service (AS) and Ticket-Granting Service (TGS) exchanges — issuing the ticket-granting tickets (TGTs) and service tickets that let users and computers prove their identity without sending passwords across the wire. It uses both UDP and TCP 88, falling back to TCP for large tickets.
Why it matters for security
Kerberos is the trust backbone of a Windows domain, so weaknesses here translate directly into domain compromise. Service tickets are encrypted with the target account's password hash, meaning any authenticated user can request tickets and crack weak passwords offline — no lockout, no logging on the target. And because the krbtgt account signs all tickets, an attacker who steals its hash can mint golden tickets that grant arbitrary access until the key is rotated.
How it's attacked
Kerberoasting requests TGS tickets for service accounts and cracks the RC4 or AES blobs offline to recover passwords. AS-REP roasting targets accounts that have pre-authentication disabled, harvesting crackable AS-REP responses. With the krbtgt hash an attacker forges golden tickets; with a service account hash, silver tickets. Stolen tickets are reused via pass-the-ticket.
Hardening checklist
Give every service account a long, random password — or better, a group Managed Service Account (gMSA) — so offline cracking fails. Require pre-authentication everywhere to kill AS-REP roasting. Rotate the krbtgt password (twice, with a gap) on a schedule and after any suspected compromise. Disable RC4 in favor of AES, and alert on bursts of TGS requests or encryption downgrades. The nmap script above enumerates valid principals on domains you are authorized to test.
Related ports
Frequently asked questions
- What is port 88 used for?
- Port 88 is the Kerberos authentication service used by Active Directory domain controllers to issue and validate authentication and ticket-granting tickets (TGTs).
- Why is Kerberos a target for attackers?
- Kerberos tickets can be cracked offline (Kerberoasting, AS-REP roasting) or forged (golden/silver tickets), letting attackers escalate privileges and persist across an AD domain.