root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to guides
root@sparrow:~/writeups$ cat guia-servicios-puertos.md
// tools

Services by Port — Enumeration & Attacks

22 Jul 2026 · 4 min read
toolsguidesrecon

A quick reference for what to do based on the port/service that shows up in an Nmap scan: what to try first, which tool to reach for, and how likely that service is to be the way in. Meant to be consulted during a machine's recon, not read top to bottom.

TypeReference table
UseQuick lookup during recon

Full port table

PortServiceAttacks / testsToolsPriority
21FTPAnonymous login, brute force, vulnerable versions (RCE)ftp, hydra, nmap --script ftp-*🔥 High
22SSHPassword spraying, brute force (with prior credentials)ssh, hydra, ncrack⚠️ Medium
23TelnetBanner grabbing, brute force — plaintext, insecuretelnet, hydra🟡 Low
25SMTPUser enumeration, Open Relay, spoofingtelnet, swaks, nmap --script smtp-*🔥 High
53DNSZone transfer (AXFR), subdomain fuzzingdig, nslookup, dnsenum, fierce🔥 High
67-68DHCPRogue DHCP (MITM)—⚠️ Low
69TFTPDownload/read accessible filestftp, tftp-hpa🔥 High if readable/writable
80 / 443HTTP / HTTPSFuzzing, LFI, RCE, RFI, SQLi — most exploitable in CTFgobuster, feroxbuster, whatweb, nikto🔥🔥 Very high
110 / 143POP3 / IMAPPassword spraying, extracting emailshydra, telnet, opensslMedium
135RPCEnumerating exposed modules (lots of Windows info)rpcclient, nmap --script rpcinfo🔥 High
137-139NetBIOSShare enumeration (pairs with SMB)nbtscan, enum4linuxMedium
389 / 636LDAPUser enumeration/dumpingldapsearch, enum4linuxHigh
445SMBFull enumeration, EternalBlue, relay, brute forceenum4linux, netexec, smbclient🔥🔥 Very high
1433MSSQLLogin, xp_cmdshell (can give RCE)hydra, mssqlclient.py🔥 High
1521OracleEnumeration, brute forceodatMedium
2049NFSList and mount exports — bad permissions = direct readshowmount, mount🔥 High
2181ZookeeperReading data without authnc, zkCli.shMedium
3306MySQLWeak passwords, database dumpsmysql, mysqldump, hydraHigh
3389RDPPassword spraying, BlueKeep if vulnerablexfreerdp, hydraMedium
5900VNCBrute force — sometimes no password at allvncviewer, hydraMedium
5985 / 5986WinRMPassword spraying, direct remote executionevil-winrm, netexec🔥 Very high
6379RedisNo auth usually gives a direct shell (write SSH keys)redis-cli🔥 Very high
8000-9000Dev serversApp enumeration, exploit frameworkswhatweb, gobusterHigh
9200ElasticsearchRCE in many vulnerable versionscurl, public PoCsHigh
11211MemcachedMemory dump — reading keys/usersmemcdumpHigh

Detail on the most common services

SMB (445) — one of the most important

Historically one of the most vulnerable services. Enumerate shares and users, try password spraying, and if the version is old, check for EternalBlue. enum4linux and netexec are the usual starting point.

WinRM (5985/5986)

If you have valid credentials (or a hash for Pass-the-Hash), WinRM gives direct remote execution via evil-winrm — usually the final step after obtaining credentials on a Windows domain.

DNS (53)

Always check whether it allows zone transfer (AXFR) — misconfigured, it reveals the entire internal domain structure at once. Otherwise, subdomain fuzzing with dnsenum/fierce.

MSSQL (1433)

If you get a login, xp_cmdshell is the stored procedure that lets you run OS commands directly from SQL — RCE if enabled (or if you have permissions to enable it).

RDP (3389)

Full graphical connection once you have credentials. Vulnerable to BlueKeep (CVE-2019-0708) on unpatched versions — pre-authentication RCE.

NFS (2049)

showmount -e <IP> lists which folders it exports. If permissions are misconfigured (no_root_squash, no IP restriction), you can mount and read/write directly with no authentication at all.