port-reference
root@sovietghost:~/tools/port-reference#
Quick reference for common ports and HTTP status codes.
PortProtoServiceDescriptionRisk
20TCPFTP-DATAFTP data transfermedium
21TCPFTPFTP control — auth in cleartexthigh
22TCPSSHSecure Shell — encrypted remote accesslow
23TCPTelnetCleartext remote shell — avoidhigh
25TCPSMTPMail transfermedium
53TCP/UDPDNSDomain Name System lookupsmedium
67UDPDHCPDHCP servermedium
68UDPDHCPDHCP clientmedium
69UDPTFTPTrivial FTP — no authhigh
80TCPHTTPUnencrypted web trafficmedium
110TCPPOP3Email retrieval (legacy)medium
111TCP/UDPRPCRemote Procedure Call portmapperhigh
119TCPNNTPUsenet news transferlow
123UDPNTPNetwork Time Protocollow
135TCPMSRPCMicrosoft RPC endpoint mapperhigh
137UDPNetBIOS-NSNetBIOS Name Servicehigh
138UDPNetBIOS-DGMNetBIOS Datagram Servicehigh
139TCPNetBIOS-SSNNetBIOS Session Service / SMBhigh
143TCPIMAPInternet Message Access Protocolmedium
161UDPSNMPSimple Network Management Protocolhigh
162UDPSNMPTRAPSNMP trap notificationsmedium
389TCPLDAPLightweight Directory Access Protocolmedium
443TCPHTTPSEncrypted web traffic (TLS)low
445TCPSMBWindows file sharing — target for lateral movementhigh
465TCPSMTPSSMTP over TLSlow
500UDPIKEIPsec key exchangemedium
514UDPSyslogRemote syslogmedium
587TCPSMTP-SUBSMTP submissionlow
631TCPIPPInternet Printing Protocolmedium
636TCPLDAPSLDAP over TLSlow
873TCPrsyncRemote file sync — can expose fileshigh
902TCPVMwareVMware authentication daemonhigh
993TCPIMAPSIMAP over TLSlow
995TCPPOP3SPOP3 over TLSlow
1080TCPSOCKSSOCKS proxymedium
1194UDPOpenVPNOpenVPNlow
1433TCPMSSQLMicrosoft SQL Serverhigh
1521TCPOracleOracle databasehigh
2049TCPNFSNetwork File Systemhigh
2181TCPZooKeeperApache ZooKeeperhigh
2375TCPDockerDocker daemon (unauthenticated)high
2376TCPDocker-TLSDocker daemon (TLS)medium
3000TCPDevCommon dev server port (Node/Rails/etc)medium
3306TCPMySQLMySQL / MariaDB databasehigh
3389TCPRDPWindows Remote Desktop — brute-force targethigh
4444TCPMetasploitMetasploit default handler porthigh
5432TCPPostgreSQLPostgreSQL databasehigh
5601TCPKibanaKibana web UIhigh
5900TCPVNCVirtual Network Computinghigh
5985TCPWinRM-HTTPWindows Remote Management (HTTP)high
5986TCPWinRM-HTTPSWindows Remote Management (HTTPS)medium
6379TCPRedisRedis key-value store — no auth by defaulthigh
6443TCPK8s APIKubernetes API serverhigh
7001TCPWebLogicOracle WebLogic Serverhigh
8080TCPHTTP-AltAlt HTTP / dev proxymedium
8443TCPHTTPS-AltAlt HTTPSlow
8888TCPJupyterJupyter Notebook (often no auth)high
9000TCPPHP-FPMPHP FastCGI Process Managerhigh
9090TCPPrometheusPrometheus metrics endpointmedium
9200TCPElasticsearchElasticsearch REST APIhigh
9300TCPES-ClusterElasticsearch cluster communicationhigh
10250TCPkubeletKubernetes kubelet APIhigh
27017TCPMongoDBMongoDB — often unauthenticatedhigh
50070TCPHDFSHadoop NameNode web UIhigh