Twenty-two protocols, as they behave on the wire.

Transfer · TCP 21 (control), TCP 20 (active data) or high ports (passive)

Clients authenticate, open a control session, then negotiate a secondary data channel to push or pull files. Nothing is encrypted by default — credentials and payloads both cross the wire in the clear.

Testing tactics

Probe for anonymous login, weak and reused credentials, and cleartext credential capture via passive sniffing before escalating to directory traversal or bounce-attack testing.

Toolkit

nmap --script ftp*, Hydra, Wireshark

Hardening

Replace with SFTP or FTPS. If FTP must remain, disable anonymous access, restrict it to a segmented VLAN, and chroot every account.

Remote access · TCP 22

A key exchange establishes a shared secret, then strong ciphers protect a channel carrying shell access, file copy (SCP/SFTP) and arbitrary port forwarding.

Testing tactics

Enumerate banner and algorithm support, test credential and key resilience, and hunt for agent-forwarding or jump-host misconfigurations that enable lateral movement and port-forwarding abuse.

Toolkit

ssh-audit, ncrack, BloodHound (where SSH ties into AD trust paths)

Hardening

Keys over passwords, disable root login, drop legacy ciphers and MACs, and never enable agent forwarding to hosts you do not fully trust.

Remote access · TCP 23

Sends keystrokes and responses in cleartext over a simple command-line session, with no confidentiality or integrity protection whatsoever.

Testing tactics

Capture credentials in transit, replay captured sessions, and exploit default accounts to demonstrate the downgrade risk against SSH.

Toolkit

nmap -sV, Medusa, tcpdump

Hardening

Disable it. There is no configuration that makes Telnet safe on a routable network; migrate to SSH and block port 23 at the perimeter and internally.

Mail · TCP 25 (relay), TCP 587 (submission, STARTTLS), TCP 465 (implicit TLS)

Store-and-forward messaging with optional TLS, moving mail from clients to servers and onward between mail transfer agents.

Testing tactics

Test for open relay, sender spoofing, header injection in mail-handling code, and STARTTLS downgrade exposing credentials.

Toolkit

swaks, smtp-user-enum, testssl.sh

Hardening

Enforce SPF, DKIM and DMARC with a reject policy, require TLS on submission, disable VRFY/EXPN, and rate-limit authenticated senders.

Web · TCP 80

A stateless request/response cycle over TCP: the client sends a method, path and headers; the server returns a status, headers and a body.

Testing tactics

Intercept and modify traffic, test for missing security headers, and demonstrate session hijacking where cookies traverse the network unprotected.

Toolkit

Burp Suite, mitmproxy, curl

Hardening

Redirect everything to HTTPS, set HSTS with a meaningful max-age, and never set session cookies over plaintext.

Web · TCP 443

A TLS handshake authenticates the server (and optionally the client) and negotiates keys, after which the HTTP exchange runs inside an encrypted, integrity-protected tunnel.

Testing tactics

Assess certificate validity and chain, protocol and cipher support, HSTS configuration, and resistance to downgrade. Test client-side pinning where mobile clients are in scope.

Toolkit

testssl.sh, sslyze, Burp Suite

Hardening

TLS 1.2 minimum and prefer 1.3, disable renegotiation and weak suites, automate certificate renewal, and consider HSTS preload for public domains.

Naming & config · UDP/TCP 53 (853 for DoT, 443 for DoH)

Recursive and authoritative resolvers answer queries hierarchically, caching results for the record's time-to-live.

Testing tactics

Attempt zone transfers, enumerate subdomains for forgotten assets, and test cache-poisoning and dangling-record conditions that enable subdomain takeover.

Toolkit

dig, dnsrecon, amass, subfinder

Hardening

Restrict zone transfers to named secondaries, deploy DNSSEC on authoritative zones, and audit CNAMEs pointing at deprovisioned cloud resources.

Naming & config · UDP 67 (server), UDP 68 (client)

A four-step discover, offer, request, acknowledge exchange leases an address plus gateway, DNS and other options to the client.

Testing tactics

Demonstrate rogue-server and starvation conditions to show how an attacker becomes the default gateway or DNS resolver for a segment.

Toolkit

Yersinia, Responder, Wireshark

Hardening

Enable DHCP snooping on access switches, define trusted uplink ports, and pair with dynamic ARP inspection.

Management · UDP 161 (queries), UDP 162 (traps)

Managers poll agents for OIDs describing device state, and agents push traps on events. v1 and v2c authenticate with a community string sent in the clear.

Testing tactics

Test for default community strings, enumerate device inventory and routing tables, and demonstrate write-community access leading to configuration change.

Toolkit

onesixtyone, snmpwalk, nmap --script snmp*

Hardening

Move to SNMPv3 with authPriv, remove public/private communities, and restrict access to a management VLAN with ACLs.

Mail · TCP 143, TCP 993 (implicit TLS)

Mail stays on the server; clients synchronise folder state, flags and message bodies on demand.

Testing tactics

Test credential resilience, check whether legacy plaintext auth remains enabled, and assess whether IMAP bypasses the MFA enforced on the web client.

Toolkit

Hydra, testssl.sh, openssl s_client

Hardening

Disable legacy basic auth, require TLS, and ensure conditional access covers mail protocols — not just the browser front end.

Mail · TCP 110, TCP 995 (implicit TLS)

The client connects, downloads waiting messages and normally removes them from the server, leaving little server-side state.

Testing tactics

Identify cleartext exposure, test credential strength, and flag it as an MFA bypass path in the same way as IMAP.

Toolkit

Hydra, tcpdump, openssl s_client

Hardening

Prefer IMAP over TLS, disable POP3 entirely where no client requires it, and never allow plaintext authentication.

Transfer · TCP 22

Runs as a subsystem of SSH, inheriting its authentication, encryption and integrity guarantees — a genuinely different protocol from FTPS.

Testing tactics

Review key management and account separation, and test whether SFTP accounts are correctly confined rather than granting a full interactive shell.

Toolkit

ssh-audit, sftp client, Wireshark

Hardening

Use ForceCommand internal-sftp with ChrootDirectory, disable shell access for transfer accounts, and rotate keys on a schedule.

Transfer · TCP 445 (TCP 139 legacy via NetBIOS)

Clients negotiate a dialect, authenticate — usually via NTLM or Kerberos — and then access shares and inter-process communication endpoints.

Testing tactics

Enumerate shares and permissions, test for null sessions, and demonstrate NTLM relay and coercion paths where signing is not enforced. This remains one of the highest-yield internal attack surfaces.

Toolkit

smbclient, enum4linux-ng, CrackMapExec, Responder, ntlmrelayx

Hardening

Require SMB signing everywhere, disable SMBv1, disable LLMNR and NBT-NS, and restrict which hosts may reach 445 across segments.

Remote access · TCP/UDP 3389

Transports display, input and device redirection over an encrypted channel, ideally with Network Level Authentication requiring credentials before a session is created.

Testing tactics

Identify internet-exposed endpoints, test for credential spraying and reuse, verify NLA is enforced, and assess certificate validation to demonstrate machine-in-the-middle risk.

Toolkit

nmap --script rdp*, xfreerdp, Hydra, Shodan (for exposure)

Hardening

Never expose RDP directly to the internet — front it with a VPN or gateway, enforce NLA and MFA, and apply account lockout with logging.

Directory & auth · TCP 389 (LDAP), TCP 636 (LDAPS), TCP 3268/3269 (global catalog)

Clients bind to a directory server and issue search or modify operations against a hierarchical tree of objects and attributes.

Testing tactics

Test for anonymous bind, enumerate users, groups and computer objects, and map ACLs to find privilege-escalation paths through the directory itself.

Toolkit

ldapsearch, BloodHound, windapsearch, adPEAS

Hardening

Require LDAP signing and channel binding, disable anonymous bind, and audit ACLs on privileged objects — that is where most AD escalation lives.

Directory & auth · TCP/UDP 88 (TCP 464 for password change)

A Key Distribution Centre issues a ticket-granting ticket after initial authentication; that ticket is then exchanged for service tickets, so credentials are not resent to each service.

Testing tactics

Test for Kerberoastable service accounts, AS-REP roastable users, and unconstrained or resource-based constrained delegation that permits impersonation.

Toolkit

Rubeus, Impacket (GetUserSPNs, GetNPUsers), BloodHound

Hardening

Long random passwords or gMSAs for service accounts, require pre-authentication, remove unconstrained delegation, and enable AES-only encryption types.

Management · UDP 123

Clients poll time servers in a stratum hierarchy and gradually correct local drift rather than stepping the clock.

Testing tactics

Check for monlist and other amplification-capable commands, and demonstrate how clock manipulation breaks Kerberos authentication, certificate validation and log correlation.

Toolkit

ntpq, nmap --script ntp-monlist

Hardening

Disable monlist, restrict queries to known clients, and source time internally from a small set of authenticated servers.

Realtime · UDP/TCP 5060, TCP 5061 (TLS)

Text-based signalling negotiates media parameters between endpoints; the media itself then flows over RTP on separately negotiated ports.

Testing tactics

Enumerate extensions, test registration and authentication strength, and assess toll-fraud exposure and unencrypted RTP capture.

Toolkit

sipvicious, Wireshark, Metasploit SIP modules

Hardening

Enforce SIP over TLS with SRTP for media, rate-limit registrations, restrict trunk access by IP, and monitor call patterns for fraud.

Realtime · TCP 1883, TCP 8883 (TLS)

Clients publish to and subscribe from topics on a broker, which fans messages out to subscribers under a chosen quality-of-service level.

Testing tactics

Test for anonymous broker access, subscribe to wildcard topics to assess data exposure, and check whether topic-level authorisation exists at all — frequently it does not.

Toolkit

mosquitto_sub, MQTT Explorer, nmap --script mqtt-subscribe

Hardening

Require TLS with client certificates, enforce per-topic ACLs, and never leave a broker reachable from the internet without authentication.

Data · TCP 6379

A simple text protocol accepts commands against in-memory structures, with optional persistence to disk.

Testing tactics

Check for unauthenticated exposure, then demonstrate the classic escalation from write access to remote code execution via config-set writes to authorized_keys or cron.

Toolkit

redis-cli, nmap --script redis-info

Hardening

Bind to localhost or a private interface, require a strong password or ACL user, disable or rename CONFIG and other dangerous commands, and never expose 6379 publicly.

Data · TCP 3306

Clients authenticate against the server and issue SQL over a binary protocol, optionally wrapped in TLS.

Testing tactics

Test for weak or reused credentials and overly broad grants, then assess whether FILE privilege or UDF creation permits reading host files or executing code.

Toolkit

mysql client, nmap --script mysql*, sqlmap (for application-layer injection)

Hardening

Never expose 3306 to the internet, grant least privilege per application user, require TLS for remote connections, and remove anonymous and test accounts.

Directory & auth · UDP 1812 (auth), UDP 1813 (accounting)

Network access servers — Wi-Fi controllers, VPN concentrators, switches — forward credentials to a RADIUS server, which returns an accept or reject decision.

Testing tactics

Assess shared-secret strength, test EAP method configuration, and demonstrate rogue-access-point credential capture where clients do not validate the server certificate.

Toolkit

eapmd5pass, hostapd-wpe, Wireshark

Hardening

Use long unique shared secrets per client, deploy EAP-TLS where possible, and enforce server-certificate validation on managed endpoints so rogue APs fail.