unicornAll work
← All theoryNetworking

Ports and services

The common ports worth memorizing and the first thought each one should trigger.

In a nutshell Every open port is a service listening — and the port number is a strong hint about what service. Knowing the common ports by heart lets you read a scan instantly and know where to look. An open port isn't the vulnerability; it's the doorway you then investigate.

one host one IP :22 SSH :80 HTTP :443 HTTPS :3306 MySQL
One machine exposes many numbered doors — each port a different service to investigate.

Why ports map to services

Standard services listen on agreed well-known ports so clients know where to connect (your browser assumes HTTPS is on 443). That convention is a gift to an attacker: the moment a scan shows port 22 open, you know SSH is there before touching it. Admins can move a service to an odd port, but most don't — so the map holds most of the time.

The ones worth memorizing

Port Service For First thought
21 FTP file transfer anonymous login? clear-text creds
22 SSH remote shell key/password login, version
23 Telnet remote shell (unencrypted) ancient, creds in clear
25 SMTP sending mail user enumeration
53 DNS name resolution zone transfer, recon
80 HTTP web (plain) a whole web app to test
139/445 SMB Windows file sharing shares, huge attack surface
443 HTTPS web (encrypted) web app + TLS
3306 MySQL database exposed DB? weak creds
3389 RDP Windows remote desktop brute-force, known CVEs
8080 HTTP-alt proxies, dev servers admin panels, test apps

Analogy — a building's directory board. The board lists which office is on which floor. A scan is you reading that board: "floor 445 — file storage, floor 3389 — remote desk." You still go up and check, but you know where things are.

Service = version = known bugs

Finding the port is step one. Step two is fingerprinting — which software and which version answers:

nmap -sV -p 22,80,443 target
# 22/tcp  open  ssh      OpenSSH 8.9p1
# 80/tcp  open  http     Apache httpd 2.4.49    ← version → look up the CVE
# 443/tcp open  ssl/http Apache httpd 2.4.49

"Apache 2.4.49" isn't trivia — it may map to a public exploit. Half of exploitation is "outdated version of a known service."

"Why is that port open?" For a defender, every open port is attack surface. A machine exposing only 443 is far smaller than one exposing SMB + RDP + MySQL + FTP to the world. "Why is that port open?" is one of the most productive questions in security — most answers are "it shouldn't be."
All theory