zeliha-infosec-journey

Port Enumeration & Exploitation Playbook

A port-by-port “what to do next” reference — for scan mechanics themselves (scan types, timing, NSE scripts, evasion), see nmap-cheatsheet-professional.md. This document picks up once a port is confirmed open and walks through enumeration → common misconfigurations/vulnerabilities → the exploitation path, service by service.

All techniques below are for use in authorized environments only — this playbook assumes an authorized lab, exam, or engagement.

Port 21 — FTP

Quick enumeration:

nmap -sV -sC -p21 <ip>
ftp <ip>                      # try anonymous:anonymous or anonymous:<blank>

Common vulnerabilities / misconfigurations:

Anonymous login enabled with write access — direct file upload path (can become a web shell drop if the FTP root overlaps a web root)
Outdated FTP daemon with known CVEs (e.g., vsftpd 2.3.4 backdoor)
Credentials reused from another service found during recon

Exploitation path:

Try anonymous login first, always — it’s free and common on CTF-style boxes.
If writable, check whether the FTP directory overlaps a web-accessible path — upload a web shell (see web-shells-cheatsheet-professional.md).
Search the banner/version against known CVEs via searchsploit (see exploitation-techniques-cheatsheet-professional.md).

Port 22 — SSH

Quick enumeration:

nmap -sV -sC -p22 <ip>
ssh -v <ip>                   # banner grab, algorithm negotiation details

Common vulnerabilities / misconfigurations:

Weak/default/reused credentials (brute-forceable)
Outdated OpenSSH version with known CVEs (e.g., user enumeration via timing, or a specific auth bypass)
Private key found elsewhere during the engagement (loot from another host/service)

Exploitation path:

If credentials or a private key were found elsewhere (web app config, FTP, SMB share), try them here first — SSH is rarely the initial foothold, usually the second step.
Only brute-force if explicitly in scope and rate-limiting/lockout risk is acceptable — see hydra-cheatsheet-professional.md.
Check version-specific CVEs if the banner reveals an old release.

Port 23 — Telnet

Quick enumeration:

nmap -sV -sC -p23 <ip>
telnet <ip>

Common vulnerabilities / misconfigurations:

Cleartext credentials (protocol itself is unencrypted — capture is trivial on the same network segment)
Often found on legacy network gear (routers/switches) with default creds

Exploitation path:

Try default vendor credentials if the banner identifies embedded/network hardware.
If credentials are known/guessed, cleartext login gives immediate interactive access — no further exploitation typically needed.

Port 25 / 587 — SMTP

Quick enumeration:

nmap -sV -sC -p25 <ip>
nc -nv <ip> 25
VRFY root                     # username enumeration if VRFY is enabled

Common vulnerabilities / misconfigurations:

User enumeration via VRFY/EXPN/RCPT TO timing differences
Open relay (can be abused for phishing infrastructure in an authorized social-engineering engagement)

Exploitation path:

Enumerate valid usernames via VRFY — feeds directly into brute-force targets for SSH/RDP/other services found on the same host.
Check for open relay if social-engineering is in scope (cross-reference social-engineering-set-cheatsheet-professional.md).

Port 53 — DNS

Quick enumeration:

dig axfr @<ip> <domain>       # attempt zone transfer
nslookup
dnsrecon -d <domain> -t axfr

Common vulnerabilities / misconfigurations:

Misconfigured zone transfer (AXFR) allowed to any requester — dumps the entire internal DNS zone (huge recon win: internal hostnames, subdomains, sometimes internal IP ranges)

Exploitation path:

Always attempt a zone transfer first — free, fast, and occasionally hands you the whole internal naming scheme.
Feed discovered hostnames back into OSINT/recon (see osint-cheatsheet.md) and vhost enumeration (see gobuster-cheatsheet-professional.md).

Port 80 / 443 / 8080 / 8443 — HTTP / HTTPS

Quick enumeration:

nmap -sV -sC -p80,443,8080,8443 <ip>
whatweb <ip>
gobuster dir -u http://<ip> -w <wordlist>

Common vulnerabilities / misconfigurations:

The single largest attack surface on most engagements — see the dedicated files below rather than duplicating here.

Exploitation path: This service gets its own full set of cheat sheets rather than a summary here — start with web-http-protocol-fundamentals-cheatsheet-professional.md, then web-enumeration-common-vulns-cheatsheet-professional.md, burp-suite-cheatsheet-professional.md, sqlmap-cheatsheet-professional.md, and web-shells-cheatsheet-professional.md once an upload/write path is found.

Port 88 — Kerberos

Quick enumeration:

nmap -sV -sC -p88 <ip>

Common vulnerabilities / misconfigurations:

Presence confirms a Domain Controller — pivot straight into AD-specific enumeration rather than generic port work.

Exploitation path: Go directly to active-directory-enumeration-cheatsheet-professional.md and the full active-directory-attack-chain-playbook.md — Kerberoasting and AS-REP Roasting both hinge on this port being open.

Port 110 / 143 — POP3 / IMAP

Quick enumeration:

nmap -sV -sC -p110,143 <ip>
nc -nv <ip> 110

Common vulnerabilities / misconfigurations:

Weak/reused credentials (try anything found elsewhere in the engagement)
Cleartext auth if not wrapped in TLS

Exploitation path:

Try credentials harvested from other services first.
A successful login often yields email content — a good source of further credentials, internal hostnames, and social-engineering context.

Port 135 — MSRPC

Quick enumeration:

nmap -sV -sC -p135 <ip>
rpcclient -U "" <ip>          # null session attempt

Common vulnerabilities / misconfigurations:

Null session enumeration (older/misconfigured Windows hosts) leaking usernames, shares, and policy info
Entry point for legacy DCOM/RPC-based exploits

Exploitation path:

Attempt a null session — if it works, enumerate users/groups directly.
This port is usually enumerated alongside 139/445 rather than in isolation — see the SMB section below and smb-windows-enumeration-cheatsheet-professional.md.

Port 139 / 445 — SMB / NetBIOS

Quick enumeration:

nmap -sV -sC -p139,445 --script smb-enum-shares,smb-os-discovery <ip>
smbclient -L //<ip>/ -N
crackmapexec smb <ip>

Common vulnerabilities / misconfigurations:

Anonymous/null session share listing
Writable shares (upload path, sometimes into a web root or startup location)
Outdated SMB version with known CVEs (EternalBlue-class, version-dependent)
Credential reuse validated at scale via CrackMapExec across a whole subnet

Exploitation path:

Enumerate shares anonymously first, always.
If a writable share is found, check where it lands on the filesystem — sometimes a direct path to code execution.
Validate any harvested credentials across the whole subnet with CrackMapExec — see crackmapexec-cheatsheet-professional.md and smb-windows-enumeration-cheatsheet-professional.md for full detail.

Port 161 — SNMP

Quick enumeration:

nmap -sU -sV -sC -p161 <ip>
snmpwalk -c public -v1 <ip>
onesixtyone <ip> community_strings.txt

Common vulnerabilities / misconfigurations:

Default community strings (public/private) exposing extensive system/config info, sometimes including plaintext credentials in the config MIB
Runs over UDP — often missed if only a TCP scan was run

Exploitation path:

Try default community strings first — extremely common finding.
snmpwalk a successful string fully; look specifically for the Windows/Cisco config-dump OIDs that sometimes leak credentials.

Port 389 / 636 — LDAP / LDAPS

Quick enumeration:

nmap -sV -sC -p389,636 <ip>
ldapsearch -x -H ldap://<ip> -b "dc=domain,dc=com"

Common vulnerabilities / misconfigurations:

Anonymous bind allowed — dumps the full directory structure (users, groups, OUs, sometimes password policy)

Exploitation path:

Attempt an anonymous bind first.
Feed the results directly into BloodHound-style AD mapping — see active-directory-enumeration-cheatsheet-professional.md.

Port 1433 — MSSQL

Quick enumeration:

nmap -sV -sC -p1433 <ip>
crackmapexec mssql <ip> -u <user> -p <pass>

Common vulnerabilities / misconfigurations:

Default sa account with a weak/blank password
xp_cmdshell enabled (or enable-able with sufficient privilege) — direct path to OS command execution
Credential reuse from other services

Exploitation path:

Try sa/blank or common default credentials.
Once authenticated, check if xp_cmdshell is enabled; if not and you have sysadmin, re-enable it — this is a direct route to a shell on the underlying host.
Follow up with metasploit-cheatsheet-professional.md MSSQL modules for a scripted path to the same result.

Port 2049 — NFS

Quick enumeration:

showmount -e <ip>
mount -t nfs <ip>:/<share> /mnt/nfs

Common vulnerabilities / misconfigurations:

no_root_squash — a mounted share lets a local root user act as remote root on the file content
Overly permissive export list (* instead of specific hosts)

Exploitation path:

List exports, mount any accessible share.
If no_root_squash is set, plant a SUID binary from a local root context to escalate on the target — see the NFS section of privilege-escalation-linux-windows-cheatsheet.md.

Port 3306 — MySQL

Quick enumeration:

nmap -sV -sC -p3306 <ip>
mysql -h <ip> -u root -p

Common vulnerabilities / misconfigurations:

Default/blank root password
FILE privilege granted — allows reading/writing arbitrary files on the host via LOAD_FILE()/INTO OUTFILE

Exploitation path:

Try root/blank first.
If FILE privilege is available and the web root is known/guessable, write a web shell directly via SELECT ... INTO OUTFILE (see web-shells-cheatsheet-professional.md).

Port 3389 — RDP

Quick enumeration:

nmap -sV -sC -p3389 <ip>
xfreerdp /v:<ip> /u:<user> /p:<pass>

Common vulnerabilities / misconfigurations:

Weak/reused/brute-forceable credentials
Known RDP-specific CVEs (BlueKeep-class — check version/patch level before attempting)

Exploitation path:

Try any credentials harvested elsewhere in the engagement first.
Only brute-force if explicitly in scope — RDP lockout policies are common and noisy.
Once in, this is typically an endpoint you already compromised another way (RDP is rarely the true initial foothold on a well-configured target).

Port 5432 — PostgreSQL

Quick enumeration:

nmap -sV -sC -p5432 <ip>
psql -h <ip> -U postgres

Common vulnerabilities / misconfigurations:

Default/weak postgres credentials
COPY ... TO/FROM PROGRAM (superuser) — direct OS command execution from within a SQL session

Exploitation path:

Try default credentials.
If superuser, use COPY ... FROM PROGRAM to execute OS commands directly — often faster than chasing a separate RCE.

Port 5900 — VNC

Quick enumeration:

nmap -sV -sC -p5900 <ip>
vncviewer <ip>

Common vulnerabilities / misconfigurations:

No authentication configured, or a weak/known VNC password
Some legacy versions have authentication-bypass CVEs

Exploitation path:

Try connecting with no password first.
If a password is set, check for reused credentials or brute-force if in scope.
A successful connection is immediate full desktop access — no further exploitation typically needed.

Port 5985 / 5986 — WinRM

Quick enumeration:

nmap -sV -sC -p5985,5986 <ip>
crackmapexec winrm <ip> -u <user> -p <pass>
evil-winrm -i <ip> -u <user> -p <pass>

Common vulnerabilities / misconfigurations:

Credential reuse from another service (WinRM is almost always a lateral movement port, not an initial foothold)

Exploitation path:

Validate any harvested domain/local credentials with CrackMapExec across the subnet first.
Use evil-winrm for an interactive PowerShell session once valid credentials are confirmed — a clean, stable alternative to a raw reverse shell.

Port 6379 — Redis

Quick enumeration:

nmap -sV -sC -p6379 <ip>
redis-cli -h <ip>

Common vulnerabilities / misconfigurations:

No authentication configured by default in older/misconfigured deployments
Can be abused to write an SSH authorized_keys file or a cron job for code execution if the Redis process has write access to relevant paths

Exploitation path:

Connect with no credentials — very commonly unauthenticated.
If writable paths are reachable, write an SSH key or cron entry via CONFIG SET dir / SAVE abuse for code execution — verify this is a known, working technique for the specific Redis version before relying on it.

Quick Decision Flow

Run the full port scan first (all 65535, not just top-1000) — see nmap-cheatsheet-professional.md.
For each open port, jump to its section above for the enumeration commands.
Prioritize: AD-indicator ports (88, 389, 445) → web (80/443) → database ports with default-credential potential → everything else.
Track every credential found across any port — most of this list assumes reuse from an earlier finding, not a fresh brute-force each time.

Scan mechanics: nmap-cheatsheet-professional.md. Credential validation at scale: crackmapexec-cheatsheet-professional.md · hydra-cheatsheet-professional.md. Category identification: attack-types-identification-cheatsheet-professional.md.

This site is open source. Improve this page.