Common Ports

Total Page：16

File Type：pdf, Size：1020Kb

Common Ports 7 Echo 540 UUCP 2483-2484 Oracle DB 6881-6999 BitTorrent 19 CHARGEN 546-547 DHCPv6 2809 CORBA Locator 6970 Quicktime 20-21 FTP 554 RTSP 2967 Symantec AV 7000-7009 AFS 22 SSH/SCP 560 rmonitor 3050 Interbase DB 7212 GhostSurf 23 Telnet 563 NNTP over TLS/SSL 3074 Xbox 7351 Cisco Meraki 25 SMTP 587 MSA (SMTP) 3124 Beacon Port 8000 Internet Radio 42 Nameserver 591 FileMaker 3128 Active API Server 8008 HTTP Alternate 43 WHOIS 593 RPC over HTTP 3222 GLBP 8080 HTTP Proxy 49 TACACS 631 Internet Printing 3260 iSCSI Target 8081 Transparent Proxy 53 DNS 636 LDAP over TLS/SSL 3306 MySQL 8086-8087 Kaspersky AV 67-68 DHCP/BOOTP 639 MSDP (PIM) 3389 RDP 8118 Privoxy 69 TFTP 646 LDP (MPLS) 3478-3481 Skype 8200 VMware Server 70 Gopher 691 MS Exchange 3689 iTunes 8500 Adobe ColdFusion 79 Finger 847 DHCP Failover 3690 Subversion 8767 TeamSpeak 80 HTTP 853 DNS over TLS 3784-3785 Ventrilo 9100 HP JetDirect 88 Kerberos (Auth) 902-903 VMware Server 4070 Spotify 9101-9103 Bacula 109 POP2 989-990 FTP over SSL 4333 mSQL 9119 Mxit 110 POP3 993 IMAP over TLS/SSL 4444 Blaster 9800 WebDAV 113 Auth 995 POP3 over TLS/SSL 4664 Google Desktop 9988 Spybot 119 NNTP (Usenet) 1025 Windows RPC 4672 eMule 9999 Urchin 123 NTP 1080 SOCKS Proxy 4899 Radmin 11371 PGP/GPG 135 Windows RPC 1109 Kerberos POP 5000 UPnP 11967 SysInfo (SSP) 137-139 NetBIOS 1194 OpenVPN 5001 Slingbox 12345 NetBus 143 IMAP 1241 Nessus 5001 iperf 13720-13721 NetBackup 161-162 SNMP 1311 Dell OpenManage 5002 RFE 17771 Hamachi 177 XDMCP 1337 WASTE 5004-5005 RTP 18475 Malwarebytes 179 BGP 1433-1434 Microsoft SQL 5060 SIP 19226 AdminSecure 201 AppleTalk 1512 WINS 5190 ICQ Messenger 19638 Ensim 220 IMAP3 1589 Cisco VLAN (VQP) 5222-5223 XMPP/Jabber 20000 Usermin 264 BGMP 1604 DarkComet RAT 5432 PostgreSQL 20011 ISDN Logging 363 RSVP Tunnel 1701 L2TP 5500 VNC Server 24800 Synergy 389 LDAP 1723 PPTP 5554 Sasser 27000-27050 Steam Client 411-412 DirectConnect 1741 CiscoWorks 2000 5631-5632 pcAnywhere 27374 ASPD 443 HTTP over TLS/SSL 1755 MS Media Server 5800 VNC over HTTP 30000 SNDMP (NDMPS) 445 Microsoft-DS 1812-1813 RADIUS 5900+ VNC Server 32400 Plex 464 Kerberos (Pass) 1935 RTMP 6000-6001 X11 33434 traceroute 465 SMTP over TLS/SSL 1985 Cisco HSRP 6112 Battle.net 497 Retrospect 2000 Cisco SCCP 6129 DameWare Classication 500 ISAKMP 2002 Cisco ACS 6346-6347 Gnutella Chat Utility 512 rexec 2049 NFS 6446 MySQL Proxy Encrypted 513 rlogin 2082-2083 cPanel 6500 GameSpy Arcade 514 syslog 2100 Oracle XDB 6566 SANE Gaming 515 LPD/LPR 2222 DirectAdmin 6588 AnalogX Security 520 RIP 2302-2400 Direct X 6665-6669 IRC Peer to Peer 521 RIPng (IPv6) 2401 CVS 6679/6697 IRC over SSL Streaming jacobriggs.io.

Copy Link

Recommended publications

Adopting Encrypted DNS in Enterprise Environments
National Security Agency | Cybersecurity Information Adopting Encrypted DNS in Enterprise Environments Executive summary Use of the Internet relies on translating domain names (like “nsa.gov”) to Internet Protocol addresses. This is the job of the Domain Name System (DNS). In the past, DNS lookups were generally unencrypted, since they have to be handled by the network to direct traffic to the right locations. DNS over Hypertext Transfer Protocol over Transport Layer Security (HTTPS), often referred to as DNS over HTTPS (DoH), encrypts DNS requests by using HTTPS to provide privacy, integrity, and “last mile” source authentication with a client’s DNS resolver. It is useful to prevent eavesdropping and manipulation of DNS traffic. While DoH can help protect the privacy of DNS requests and the integrity of responses, enterprises that use DoH will lose some of the control needed to govern DNS usage within their networks unless they allow only their chosen DoH resolver to be used. Enterprise DNS controls can prevent numerous threat techniques used by cyber threat actors for initial access, command and control, and exfiltration. Using DoH with external resolvers can be good for home or mobile users and networks that do not use DNS security controls. For enterprise networks, however, NSA recommends using only designated enterprise DNS resolvers in order to properly leverage essential enterprise cybersecurity defenses, facilitate access to local network resources, and protect internal network information. The enterprise DNS resolver may be either an enterprise-operated DNS server or an externally hosted service. Either way, the enterprise resolver should support encrypted DNS requests, such as DoH, for local privacy and integrity protections, but all other encrypted DNS resolvers should be disabled and blocked.
[Show full text]
The ISP Column Diving Into The
The ISP Column A column on various things Internet October 2018 Geoff Huston Diving into the DNS DNS OARC organizes two meetings a year. They are two-day meetings with a concentrated dose of DNS esoterica. Here’s what I took away from the recent 29th meeting of OARC, held in Amsterdam in mid-October 2018. Cloudflare's 1.1.1.1 service Cloudflare have been running an open public DNS resolver service on 1.1.1.1 for more than six months now. The service, based on the Knot resolver engine, is certainly fast (http://bit.ly/2PBfoSh), and Cloudflare's attention to scale and speed is probably appreciated by users of this service. However, in a broader Internet environment that is now very aware of personal privacy it’s not enough to be fast and accurate. You have to be clear that as an operator of a public DNS resolution service you may be privy to clients’ activities and interests, and you need to clearly demonstrate that you are paying attention to privacy. Not only does this include appropriate undertakings regarding the way you handle and dispose of the logs of the resolvers' query streams, but also in being mindful of the way that users can pass queries to the service. The 1.1.1.1 service supports DNS over TLS 1.3 and 1.2 using the GnuTLS system. This supports long-lived connection with client systems and also supports session resumption. There are a number of DNS tools that can use the DNS over a TLS connection including kdig (http://bit.ly/2A9f9rX, http://bit.ly/2OoLu7a), GetDNS (https://getdnsapi.net/), Unbound (http://bit.ly/2CIKEf0), Android P and the Tenta browser (https://tenta.com/).
[Show full text]
List of NMAP Scripts Use with the Nmap –Script Option
List of NMAP Scripts Use with the nmap –script option Retrieves information from a listening acarsd daemon. Acarsd decodes ACARS (Aircraft Communication Addressing and Reporting System) data in real time. The information retrieved acarsd-info by this script includes the daemon version, API version, administrator e-mail address and listening frequency. Shows extra information about IPv6 addresses, such as address-info embedded MAC or IPv4 addresses when available. Performs password guessing against Apple Filing Protocol afp-brute (AFP). Attempts to get useful information about files from AFP afp-ls volumes. The output is intended to resemble the output of ls. Detects the Mac OS X AFP directory traversal vulnerability, afp-path-vuln CVE-2010-0533. Shows AFP server information. This information includes the server's hostname, IPv4 and IPv6 addresses, and hardware type afp-serverinfo (for example Macmini or MacBookPro). Shows AFP shares and ACLs. afp-showmount Retrieves the authentication scheme and realm of an AJP service ajp-auth (Apache JServ Protocol) that requires authentication. Performs brute force passwords auditing against the Apache JServ protocol. The Apache JServ Protocol is commonly used by ajp-brute web servers to communicate with back-end Java application server containers. Performs a HEAD or GET request against either the root directory or any optional directory of an Apache JServ Protocol ajp-headers server and returns the server response headers. Discovers which options are supported by the AJP (Apache JServ Protocol) server by sending an OPTIONS request and lists ajp-methods potentially risky methods. ajp-request Requests a URI over the Apache JServ Protocol and displays the result (or stores it in a file).
[Show full text]
Ikev2 Configuration for Encrypted DNS
IKEv2 Configuration for Encrypted DNS draft-btw-add-ipsecme-ike Mohamed Boucadair (Orange) Tirumaleswar Reddy (McAfee, Inc.) Dan Wing (Citrix Systems, Inc.) Valery Smyslov (ELVIS-PLUS) July 2020, IETF#108 Agenda • Context • A Sample Use Case • IKE Configuration Attribute for Encrypted DNS • Next Steps 2 Problem Description • Several schemes to encrypt DNS have been specified – DNS over TLS (RFC 7858) – DNS over DTLS (RFC 8094) – DNS over HTTPS (RFC 8484) • …And others are being specified: – DNS over QUIC (draft-ietf-dprive-dnsoquic) • How to securely provision clients to use Encrypted DNS? This use can be within or outside the IPsec tunnel 3 A Sample Use Case: DNS Offload • VPN service providers can offer publicly accessible Encrypted DNS – the split-tunnel VPN configuration allows the client to access the DoH/DoT servers hosted by the VPN provider without traversing the tunnel 4 A Sample Use Case: Protecting Internal DNS Traffic • DoH/DoT ensures DNS traffic is not susceptible to internal attacks – see draft-arkko-farrell-arch-model-t-03#section-3.2.1 • encrypted DNS can benefit to Roaming Enterprise users to enhance privacy – With DoH/DoT the visibility of DNS traffic is limited to only the parties authorized to act on the traffic (“Zero Trust Architecture”) 5 Using IKE to Configure Encrypted DNS on Clients • New configuration attribute INTERNAL_ENC_DNS is defined to convey encrypted DNS information to clients: – Encrypted DNS type (e.g., DoH/DoT) – Scope of encrypted DNS use – One or more encrypted DNS server IPv6 addresses • For IPv4
[Show full text]
Chapter 3 Composite Default Screen Blind Folio 3:61
Color profile: GenericORACLE CMYK printerTips & Techniques profile 8 / Oracle9i for Windows 2000 Tips & Techniques / Jesse, Sale, Hart / 9462-6 / Chapter 3 Composite Default screen Blind Folio 3:61 CHAPTER 3 Configuring Windows 2000 P:\010Comp\OracTip8\462-6\ch03.vp Wednesday, November 14, 2001 3:20:31 PM Color profile: GenericORACLE CMYK printerTips & Techniques profile 8 / Oracle9i for Windows 2000 Tips & Techniques / Jesse, Sale, Hart / 9462-6 / Chapter 3 Composite Default screen Blind Folio 3:62 62 Oracle9i for Windows 2000 Tips & Techniques here are three basic configurations of Oracle on Windows 2000: as T a management platform, as an Oracle client, and as a database server. The first configuration is the platform from which you will manage Oracle installations across various machines on various operating systems. Most system and database administrators are given a desktop PC to perform day-to-day tasks that are not DBA specific (such as reading e-mail). From this desktop, you can also manage Oracle components installed on other operating systems (for example, Solaris, Linux, and HP-UX). Even so, you will want to configure Windows 2000 to make your system and database administrative tasks quick and easy. The Oracle client software configuration is used in more configurations than you might first suspect: ■ Web applications that connect to an Oracle database: ■ IIS 5 ASPs that use ADO to connect to an Oracle database ■ Perl DBI application running on Apache that connects to an Oracle database ■ Any J2EE application server that uses the thick JDBC driver ■ Client/server applications: ■ Desktop Visual Basic application that uses OLEDB or ODBC to connect to an Oracle Database ■ Desktop Java application that uses the thick JDBC to connect to Oracle In any of these configurations, at least an Oracle client installation is required.
[Show full text]
A Cybersecurity Terminarch: Use It Before We Lose It
SYSTEMS ATTACKS AND DEFENSES Editors: Davide Balzarotti, [email protected] | William Enck, [email protected] | Samuel King, [email protected] | Angelos Stavrou, [email protected] A Cybersecurity Terminarch: Use It Before We Lose It Eric Osterweil | George Mason University term · in · arch e /’ t re m , närk/ noun an individual that is the last of its species or subspecies. Once the terminarch dies, the species becomes extinct. hy can’t we send encrypt- in the Internet have a long history W ed email (secure, private of failure. correspondence that even our mail To date, there has only been one providers can’t read)? Why do our success story, and, fortunately, it is health-care providers require us to still operating. Today, almost ev- use secure portals to correspond erything we do online begins with a with us instead of directly emailing query to a single-rooted hierarchical us? Why are messaging apps the global database, whose namespace only way to send encrypted messag- is collision-free, and which we have es directly to friends, and why can’t relied on for more than 30 years: we send private messages without the Domain Name System (DNS). user-facing) layer(s). This has left the agreeing to using a single platform Moreover, although the DNS pro- potential to extend DNSSEC’s verifi- (WhatsApp, Signal, and so on)? Our tocol did not initially have verifica- cation protections largely untapped. cybersecurity tools have not evolved tion protections, it does now: the Moreover, the model we are using to offer these services, but why? DNS Security Extensions (DNS- exposes systemic vulnerabilities.
[Show full text]
DNS As a Multipurpose Attack Vector
PANEPISTHMIO AIGAIOU DIDAKTORIKH DIATRIBH To Prwtόκοllo DNS wc Poluleitουργικός Forèac EpÐjeshc Suggrafèac: Μάριoc Anagnwstόπουλος Epiblèpwn: Αναπληρωτής Kaj. Ge¸rgioc Καμπουράκης Diatrιβή gia thn aπόκτηση Didaktorikoύ Dipl¸matoc tou ErgasthrÐou Ασφάλειας Plhroforiak¸n kai Epikoinwniak¸n Συστημάτwn Τμήματoc Mhqanik¸n Plhroforiak¸n kai Epikoinwniak¸n Συστημάτwn Septèmbrioc, 2016 University of the Aegean Doctoral Thesis DNS as a multipurpose attack vector Author: Marios Anagnostopoulos Supervisor: Associate Prof. Georgios Kambourakis A thesis submitted in fulﬁlment of the requirements for the degree of Doctor of Philosophy at the Laboratory of Information and Communication Systems Security Department of Information and Communication Systems Engineering September, 2016 Declaration of Authorship I, Marios Anagnostopoulos, declare that this thesis entitled, \DNS as a multipurpose attack vector" and the work presented in it are my own. I conﬁrm that: This work was done wholly while in candidature for a research degree at this University. Where I have consulted the published work of others, this is always clearly at- tributed. Where I have quoted from the work of others, the source is always given. With the exception of such quotations, this thesis is entirely my own work. I have acknowledged all main sources of help. Where the thesis is based on work done by myself jointly with others, I have made clear exactly what was done by others and what I have contributed myself. Signed: Date: September 28, 2016 i Advising Committee of this Doctoral
[Show full text]
Detecting Malware in TLS Traffic
IMPERIAL COLLEGE LONDON DEPARTMENT OF COMPUTING Detecting Malware in TLS Traffic Project Report Supervisor: Author: Sergio Maffeis Olivier Roques Co-Supervisor: Marco Cova Submitted in partial fulfillment of the requirements for the MSc degree in Computing Science / Security and Reliability of Imperial College London September 2019 Abstract The use of encryption on the Internet has spread rapidly these last years, a trend encouraged by the growing concerns about online privacy. TLS (Transport Layer Security), the standard protocol for packet encryption, is now implemented by every major websites to protect users’ messages, transactions and credentials. However cybercriminals have started to incorporate TLS into their activities. An increasing number of malware leverage TLS encryption to hide their communications and to exfiltrate data to their command server, effectively bypassing traditional detection platforms. The goal of this project is to design and implement an effective alternative to the unpractical method of decrypting TLS packets’ payload before looking for signs of malware activity. This work presents a highly accurate supervised classifier that can detect malicious TLS flows in a company’s network traffic based on a set of features related to TLS, certificates and flow metadata. The classifier was trained on curated datasets of benign and malware observations, which were extracted from capture files thanks to a set of tools specially developed for this purpose. We detail in this report the complete development process, from data collection and feature extraction to model selection and performance analysis. ii Acknowledgments I would like to particularly thank Marco Cova and Sergio Maffeis, my project su- pervisors, for their valuable and continuous suggestions and for their constructive feedbacks on this project.
[Show full text]
The ISP Column Ipv6 and The
The ISP Column On Things Internet July 2020 Geoff Huston IPv6 and the DNS These days it seems that whenever we start talking about the DNS the conversation immediately swings around to the subject of DNS over HTTPS (DoH) and the various implications of this technology in terms of changes in the way the DNS is used. It’s true that DoH is a rich topic space and while much has been said and written already, there is still more to say (and write). But that's not my intention here. I’d like to look at a different, but still very familiar and somewhat related, topic relating to the DNS, namely how IPv6 is being used as a transport protocol for DNS queries. Before I set out the questions that I want to consider here, it’s useful to remember why we are deploying IPv6 in the first place. IPv6 is not intended to sit alongside IPv4 in a dual-stack situation as the end objective of this transition process. A fully deployed dual-stack world is not the goal here. We need to push this transition process one step further, and the objective is to get to the point where IPv4 is not only no longer necessary but no longer used at all. In other words, we are attempting to get to the point where IPv6-only services are not only a viable way of using the Internet but are the only way of using the Internet. One of the key elements in the overall transition is the way in which we manage a dual-stack networked environment.
[Show full text]
Network Security Knowledge Area
Network Security Knowledge Area Prof. Christian Rossow CISPA Helmholtz Center for Information Security Prof. Sanjay Jha University of New South Wales © Crown Copyright, The National Cyber Security Centre 2021. This information is licensed under the Open Government Licence v3.0. To view this licence, visit http://www.nationalarchives.gov.uk/doc/open- government-licence/. When you use this information under the Open Government Licence, you should include the following attribution: CyBOK Network Security Knowledge Area Version 2.0 © Crown Copyright, The National Cyber Security Centre 2021, licensed under the Open Government Licence http://www.nationalarchives.gov.uk/doc/open- government-licence/. The CyBOK project would like to understand how the CyBOK is being used and its uptake. The project would like organisations using, or intending to use, CyBOK for the purposes of education, training, course development, professional development etc. to contact it at [email protected] to let the project know how they are using CyBOK. Security Goals What does it mean to be secure? • Most common security goals: “CIA triad” – Confidentiality: untrusted parties cannot infer sensitive information – Integrity: untrusted parties cannot alter information – Availability: service is accessible by designated users all the time • Additional security goals – Authenticity: recipient can verify that sender is origin of message – Non-Repudiation: anyone can verify that sender is origin of message – Sender/Recipient Anonymity: communication cannot be traced back to
[Show full text]
HTTP: IIS "Propfind" Rem HTTP:IIS:PROPFIND Minor Medium
HTTP: IIS "propfind"HTTP:IIS:PROPFIND RemoteMinor DoS medium CVE-2003-0226 7735 HTTP: IkonboardHTTP:CGI:IKONBOARD-BADCOOKIE IllegalMinor Cookie Languagemedium 7361 HTTP: WindowsHTTP:IIS:NSIISLOG-OF Media CriticalServices NSIISlog.DLLcritical BufferCVE-2003-0349 Overflow 8035 MS-RPC: DCOMMS-RPC:DCOM:EXPLOIT ExploitCritical critical CVE-2003-0352 8205 HTTP: WinHelp32.exeHTTP:STC:WINHELP32-OF2 RemoteMinor Buffermedium Overrun CVE-2002-0823(2) 4857 TROJAN: BackTROJAN:BACKORIFICE:BO2K-CONNECT Orifice 2000Major Client Connectionhigh CVE-1999-0660 1648 HTTP: FrontpageHTTP:FRONTPAGE:FP30REG.DLL-OF fp30reg.dllCritical Overflowcritical CVE-2003-0822 9007 SCAN: IIS EnumerationSCAN:II:IIS-ISAPI-ENUMInfo info P2P: DC: DirectP2P:DC:HUB-LOGIN ConnectInfo Plus Plus Clientinfo Hub Login TROJAN: AOLTROJAN:MISC:AOLADMIN-SRV-RESP Admin ServerMajor Responsehigh CVE-1999-0660 TROJAN: DigitalTROJAN:MISC:ROOTBEER-CLIENT RootbeerMinor Client Connectmedium CVE-1999-0660 HTTP: OfficeHTTP:STC:DL:OFFICEART-PROP Art PropertyMajor Table Bufferhigh OverflowCVE-2009-2528 36650 HTTP: AXIS CommunicationsHTTP:STC:ACTIVEX:AXIS-CAMERAMajor Camerahigh Control (AxisCamControl.ocx)CVE-2008-5260 33408 Unsafe ActiveX Control LDAP: IpswitchLDAP:OVERFLOW:IMAIL-ASN1 IMail LDAPMajor Daemonhigh Remote BufferCVE-2004-0297 Overflow 9682 HTTP: AnyformHTTP:CGI:ANYFORM-SEMICOLON SemicolonMajor high CVE-1999-0066 719 HTTP: Mini HTTP:CGI:W3-MSQL-FILE-DISCLSRSQL w3-msqlMinor File View mediumDisclosure CVE-2000-0012 898 HTTP: IIS MFCHTTP:IIS:MFC-EXT-OF ISAPI FrameworkMajor Overflowhigh (via
[Show full text]
Growth and Commoditization of Remote Access Trojans
30 September - 2 October, 2020 / vblocalhost.com GROWTH AND COMMODITIZATION OF REMOTE ACCESS TROJANS Veronica Valeros & Sebastian García Czech Technical University in Prague, Czech Republic [email protected] [email protected] www.virusbulletin.com GROWTH AND COMMODITIZATION OF REMOTE ACCESS TROJANS VALEROS & GARCÍA ABSTRACT Remote access trojans (RATs) are an intrinsic part of traditional cybercriminal activities, and they have also become a standard tool in advanced espionage attacks and scams. There have been significant changes in the cybercrime world in terms of organization, attacks and tools in the last three decades, however, the overly specialized research on RATs has led to a seeming lack of understanding of how RATs in particular have evolved as a phenomenon. The lack of generalist research hinders the understanding and development of new techniques and methods to better detect them. This work presents the first results of a long-term research project looking at remote access trojans. Through an extensive methodological process of collection of families of RATs, we are able to present an analysis of the growth of RATs in the last 30 years. Through a closer analysis of 11 selected RATs, we discuss how they have become a commodity in the last decade. Finally, through the collected information we attempt to characterize RATs, their victims, attacks and operators. Preliminary results of our ongoing research have shown that the number of RATs has increased drastically in the past ten years and that nowadays RATs have become standardized commodity products that are not very different from each other. INTRODUCTION Remote access software is a type of computer program that allows an individual to have full remote control of the device on which the software is installed.
[Show full text]