Ports Flashcards
(22 cards)
Port 21
File Transfer Protocol (FTP) - send username and password using plaintext from the client to the server
Port 23
Telnet- used by many Linux systems as basic text-based terminal
All information to/from host on telnet connection is sent in plaintext and can be intercepted by an attacker
Secure File Transfer Protocol (SFTP)
Port 22- secure alternative using encryption to protect user credentials and packets of data being transferred
Secure Shell (SSH)
Port 22- Uses encryption to ensure traffic between the host and terminal is not sent in plaintext format
Port 25
Simple Mail Transfer Protocol (SMTP)- default unencrypted port for sending email addresses
Port 37
Time Protocol- may be used by legacy equipment. Used for time.
Port 587
Secure alternative for SMTP is Transport Layer Security (TLS) which will encrypt data between mail client and mail server
Port 123
Network Time Protocol (NTP)- mostly replaced Time Protocol by offering better error handing capabilities, reducing likelihood of unexpected errors, a widely used Internet protocol that synchronizes computer clocks across a network, ensuring accurate timekeeping for various applications and services
Port 53
Domain Name Service (DNS)- still widely used. Acts as the internet’s “phone book”, translating human-friendly domain names (like google.com) into numerical IP addresses (like 192.0.2.1) that computers use to communicate
Port 853
DNS over TLS (DoT) protects DNS information from being modified in transit
Port 80
HyperText Transfer Protocol (HTTP)- basis of nearly all web browser traffic on the internet. Information sent via HTTP not encrypted.
HTTPS using TLS encryption is preferred because it protects data in transit between server and browser. (often notated as SSL/TLS)
Secure Sockets Layer (SSL)
has been compromised and is no longer considered secure
Transport Layer Security (TLS)
is now recommended that web servers and clients use Transport Layer Security (TLS) 1.3 or higher for the best protection
TLS is a cryptographic protocol that ensures secure communication between a client and a server over a computer network, protecting data transmitted from eavesdropping and tampering.
Port 143
Internet Message Access Protocol (IMAP)- protocol used for retrieving emails. Traffic is not encrypted and is susceptible to network sniffing.
Port 161 and 162
Simple Network Management Protocol (SNMP) version 2 or 3- recommended to include encryption and additional security features
SNMP is a protocol for monitoring and managing network devices, facilitating the exchange of information between network devices and management systems
Port 445
Server Message Block (SMB)- used by many versions of Windows for accessing files over the network. network communication protocol enabling computers to share files, printers, serial ports, and other resources over a network. Files are transmitted UNENCRYPTED and many vulnerabilities are well known. Recommended traffic on port 445 should not be allowed to pass through a firewall at the network perimeter
Port 2049
Network File System (NFS)- More secure alternative to Secure Message Block (SMB) port 445. It is recommended that NFS not be allowed through firewalls.
Port 389- Lightweight Directory Access Protocol (LDAP)
Lightweight Directory Access Protocol (LDAP)- Used to communicate directory information from servers to clients.
This can be an address book for email or usernames for login. The LDAP protocol also allow records in the directory to be updated, which includes additional risk. LDAP is not encrypted, making it susceptible to sniffing and manipulation attacks.
Three way handshake
A system for synchronizing and acknowledging any request, used to establish a TCP connection between 2 devices
SYN/ACK
web server replies to the SYN packet with an acknowledgement known as SYN/ACK
Synchronization (SYN) packets
to establish communications on a web server, to the web server’s port 80 or 443
Acknowledgement (ACK)
Client acknowledges connection with an acknowledgement (ACK)
At this point, the basic connection is established and client and host will further negotiate secure communications over that connection.
