Cheat sheets / Ports & protocols (colored)
Ports & protocols (colored)
Every port the exam expects, colored by verdict — secure (use), insecure (close or replace), normally open, and restrict-to-internal.
Legend
| ✔ Secure — use | Encrypted/authenticated; the answer when a question says "most secure" or "replace X with" |
| ✖ Insecure — close or replace | Cleartext credentials/data; disable it, or the exam wants its secure replacement |
| ● Normally open | Expected on most networks/hosts; not a finding by itself, but watch what's behind it |
| ⚠ Restrict — internal / management only | Fine inside the LAN or a management VLAN; must never be exposed to the internet |
| ○ Legacy / rare | Know the number; you should not see it in a modern network |
The port table
| Port | Protocol | Transport | Verdict | Why / what to do |
|---|---|---|---|---|
| 20 / 21 | FTP (data / control) | TCP | ✖ Insecure | Cleartext creds and files → use SFTP (22) or FTPS (989/990) |
| 22 | SSH · SCP · SFTP | TCP | ✔ Secure | Replaces Telnet/FTP/rlogin; key-based auth; still restrict source IPs — brute-force target |
| 23 | Telnet | TCP | ✖ Insecure | Cleartext everything → SSH 22. Should be closed everywhere |
| 25 | SMTP (server-to-server relay) | TCP | ⚠ Mail servers only | Needed on MX hosts; use STARTTLS; block outbound 25 from workstations (spam/botnets) |
| 49 | TACACS+ | TCP | ⚠ Internal | Device admin AAA (Cisco); encrypts the whole body — management network only |
| 53 | DNS | UDP + TCP | ● Normally open | Everyone needs it; add DNSSEC for integrity, DoH 443 / DoT 853 for privacy; watch for tunneling/exfil |
| 67 / 68 | DHCP (server / client) | UDP | ● Normally open (LAN) | Local only; DHCP snooping stops rogue servers; relay agent crosses subnets |
| 69 | TFTP | UDP | ✖ Insecure | No auth, no encryption; only for isolated device-boot networks → close |
| 80 | HTTP | TCP | ✖ Insecure | Cleartext → HTTPS 443; keep 80 only to redirect to 443 |
| 88 | Kerberos | TCP/UDP | ⚠ Internal | AD authentication; needs NTP sync; never internet-facing |
| 110 | POP3 | TCP | ✖ Insecure | Cleartext mail download → POP3S 995 |
| 123 | NTP | UDP | ● Normally open | Clock sync for Kerberos/logs/certs; restrict to trusted time sources; amplification-DDoS reflector if open to the world |
| 135 · 137–139 | RPC · NetBIOS | TCP/UDP | ⚠ Internal only | Windows LAN plumbing; block at the perimeter; nbtstat enumeration |
| 143 | IMAP | TCP | ✖ Insecure | Cleartext → IMAPS 993 |
| 161 / 162 | SNMP (agent / trap) | UDP | ⚠ Internal — v3 only | v1/v2c community strings are cleartext (SNMP enumeration) → SNMPv3; management VLAN |
| 389 | LDAP | TCP/UDP | ✖ Insecure | Cleartext directory binds → LDAPS 636 (or StartTLS); internal only either way |
| 443 | HTTPS (TLS) | TCP | ✔ Secure · normally open | The one port that's almost always open; TLS 1.2/1.3 only; also TLS VPNs, DoH |
| 445 | SMB | TCP | ⚠ Internal only | File shares; SMB1 must be disabled (WannaCry); block at the perimeter; SMB3 signing/encryption |
| 465 / 587 | SMTPS / SMTP submission (STARTTLS) | TCP | ✔ Secure | Client mail sending with TLS; 587 is the modern submission port |
| 500 / 4500 | IKE / NAT-T (IPsec) | UDP | ✔ Secure | IPsec VPN key exchange; ESP = IP protocol 50, AH = 51 |
| 514 | Syslog | UDP | ⚠ Internal | Cleartext, no delivery guarantee → syslog over TLS 6514; internal collector only |
| 636 | LDAPS | TCP | ✔ Secure | LDAP over TLS |
| 853 | DNS over TLS | TCP | ✔ Secure | Encrypted DNS queries (DoH uses 443) |
| 989 / 990 | FTPS | TCP | ✔ Secure | FTP over TLS (SFTP over SSH is more common) |
| 993 | IMAPS | TCP | ✔ Secure | IMAP over TLS |
| 995 | POP3S | TCP | ✔ Secure | POP3 over TLS |
| 1194 | OpenVPN | UDP/TCP | ✔ Secure | TLS-based VPN |
| 1433 · 3306 · 1521 · 5432 | MS SQL · MySQL · Oracle · PostgreSQL | TCP | ⚠ Internal only | Database listeners must never face the internet; app tier only, TLS + auth |
| 1701 | L2TP | UDP | ⚠ Only with IPsec | No encryption by itself — always L2TP/IPsec |
| 1723 | PPTP | TCP | ○ Legacy — close | Broken MS-CHAP; replace with IPsec/TLS VPN |
| 1812 / 1813 | RADIUS (auth / accounting) | UDP | ⚠ Internal | AAA for 802.1X/Wi-Fi; only the password is encrypted — keep on the management network (legacy 1645/1646) |
| 2049 | NFS | TCP | ⚠ Internal only | Unix file shares; NFSv4 with Kerberos; never exposed |
| 3389 | RDP | TCP | ⚠ Never internet-facing | #1 ransomware entry point; VPN/jump host + MFA + NLA; TLS on 3389 |
| 5060 / 5061 | SIP / SIP-TLS | TCP/UDP | ⚠ Restrict | VoIP signaling; 5061 = TLS; media via SRTP |
| 6514 | Syslog over TLS | TCP | ✔ Secure | Encrypted, reliable log forwarding |
| 8080 / 8443 | HTTP-alt / HTTPS-alt | TCP | ⚠ Check | Proxies, admin consoles, dev servers — often forgotten and unpatched |
| 4444 | (Metasploit / netcat default) | TCP | ✖ Should never exist | A listener here in netstat is a backdoor indicator |
Secure replacements at a glance
| Replace this | With this | |
|---|---|---|
| Telnet 23 | → | SSH 22 |
| FTP 20/21 | → | SFTP 22 · FTPS 989/990 |
| HTTP 80 | → | HTTPS 443 |
| SMTP 25 (client) | → | SMTPS 465 · submission 587 + STARTTLS |
| POP3 110 | → | POP3S 995 |
| IMAP 143 | → | IMAPS 993 |
| LDAP 389 | → | LDAPS 636 |
| SNMP v1/v2c | → | SNMPv3 (same 161/162) |
| DNS 53 (plain) | → | DNSSEC · DoT 853 · DoH 443 |
| Syslog 514 | → | Syslog-TLS 6514 |
| RTP | → | SRTP |
| PPTP 1723 · L2TP alone | → | IPsec (500/4500) · OpenVPN 1194 · TLS VPN 443 |
| WEP · WPA/TKIP | → | WPA2-CCMP · WPA3-SAE/GCMP |
| SSL · TLS 1.0/1.1 | → | TLS 1.2 / 1.3 |
Protocol cheat facts
| Protocol | Layer / transport | Remember |
|---|---|---|
| TLS 1.2 / 1.3 | Transport-layer security over TCP | 1.3 removed weak ciphers and RSA key exchange — ECDHE only (forward secrecy); SSL and TLS 1.0/1.1 are ✖ |
| IPsec | Network layer | AH = integrity/auth only (no encryption); ESP = encryption + integrity. Transport mode protects payload; tunnel mode wraps the whole packet (site-to-site VPN) |
| SSH | 22 / TCP | Replaces Telnet, rlogin; key-based auth |
| S/MIME | Signs/encrypts individual emails with certificates | |
| SPF / DKIM / DMARC | DNS TXT records | SPF = who may send; DKIM = signature; DMARC = policy + reporting |
| SRTP | RTP over UDP | Secure voice/video media |
| WPA2 | Wi-Fi | AES-CCMP; PSK (Personal) or 802.1X/EAP (Enterprise); PSK handshake crackable offline |
| WPA3 | Wi-Fi | SAE handshake (Personal), 192-bit GCMP mode (Enterprise), forward secrecy |
| WEP · WPA/TKIP · WPS | Wi-Fi | Broken RC4 / deprecated / PIN brute-forced — disable |
| 802.1X | Port-based NAC | Supplicant → authenticator (switch/AP) → authentication server (RADIUS); EAP inside |
| EAP-TLS | 802.1X method | Certificates on both sides — strongest |
| PEAP / EAP-TTLS | 802.1X method | Server cert, tunnel protects inner user credential |
| PAP · CHAP · LEAP · PPTP | Legacy auth / VPN | Cleartext / weak challenge / broken — don't use (class: "PAP don't use; CHAP don't use") |
| LDAP → LDAPS | 389 / 636 | Directory queries (AD); LDAPS for TLS |
| Kerberos | 88 | KDC issues TGT then service tickets; time-sensitive (clock skew ≤ 5 min) |
| RADIUS vs. TACACS+ | UDP 1812 / TCP 49 | RADIUS encrypts only the password; TACACS+ encrypts the whole body |
| SAML | XML over HTTPS | Federated SSO for web apps; IdP ↔ SP |
| OAuth 2.0 / OIDC | HTTPS | OAuth = delegated authorization; OIDC adds authentication on top |
| SNMP v1/v2c → v3 | 161/162 UDP | Community strings are cleartext; v3 adds authentication + encryption |
Memory hooks
- "Two-two SSH, two-three tell-net" — 22 SSH, 23 Telnet.
- Mail: 25 sends, 110 pops, 143 imaps → secure: 465/587, 995, 993 (add ~850 to POP/IMAP).
- 389 → 636 LDAP → LDAPS.
- 3389 = RDP ("three-three-eight-nine, remote desktop every time") — and it's the one to hide behind a VPN.
- AH = Authentication only; ESP = Encrypted Secure Payload.
- Red row in a scenario = the finding; green row = the fix.