1 1 00:00:00,120 --> 00:00:03,030 Transmission Control Protocol Ports. 2 2 00:00:03,030 --> 00:00:04,830 Now, as a cybersecurity analyst, 3 3 00:00:04,830 --> 00:00:07,260 you have to know some TCP port numbers 4 4 00:00:07,260 --> 00:00:08,700 for the different registered ports 5 5 00:00:08,700 --> 00:00:10,650 that are commonly scanned against. 6 6 00:00:10,650 --> 00:00:12,570 This way as you're going through your logs, 7 7 00:00:12,570 --> 00:00:14,700 you don't have to keep looking them up each time. 8 8 00:00:14,700 --> 00:00:16,470 If you see a port like port 80, 9 9 00:00:16,470 --> 00:00:18,060 you should know that's web traffic. 10 10 00:00:18,060 --> 00:00:20,280 It's HTTP, for instance. 11 11 00:00:20,280 --> 00:00:21,810 In this lesson, I'm going to go through 12 12 00:00:21,810 --> 00:00:24,420 the most common ports that you need to know for the exam. 13 13 00:00:24,420 --> 00:00:26,010 We're going to go through them fairly quickly 14 14 00:00:26,010 --> 00:00:28,260 because these are all things you should know already 15 15 00:00:28,260 --> 00:00:32,370 from your previous studies in Security+, Network+, or A+. 16 16 00:00:32,370 --> 00:00:34,350 If there's any of these that you don't understand, 17 17 00:00:34,350 --> 00:00:36,480 make a note of it, go on to Google, 18 18 00:00:36,480 --> 00:00:37,890 and look it up so you can understand 19 19 00:00:37,890 --> 00:00:40,620 what that service is and what it's used for. 20 20 00:00:40,620 --> 00:00:43,350 First, we have 21, which is FTP. 21 21 00:00:43,350 --> 00:00:45,120 This is the File Transfer Protocol. 22 22 00:00:45,120 --> 00:00:48,090 This is used, as you could guess, to transfer files. 23 23 00:00:48,090 --> 00:00:50,400 Essentially, if you're running an FTP server, 24 24 00:00:50,400 --> 00:00:52,740 port 21 would be open on your firewall. 25 25 00:00:52,740 --> 00:00:56,970 Next, we have port 22, which is SSH or SFTP. 26 26 00:00:56,970 --> 00:00:58,560 SSH is Secure Shell. 27 27 00:00:58,560 --> 00:01:01,650 It is remote access tool to give you command line access 28 28 00:01:01,650 --> 00:01:02,970 over a remote system. 29 29 00:01:02,970 --> 00:01:06,870 Now, when you're dealing with SFTP, this is FTP over SSH, 30 30 00:01:06,870 --> 00:01:08,790 which allows you to take File Transfer Protocol 31 31 00:01:08,790 --> 00:01:11,610 and run it securely through an SSH secure tunnel. 32 32 00:01:11,610 --> 00:01:14,010 Then we have port 23, Telnet. 33 33 00:01:14,010 --> 00:01:17,130 Telnet is an unsecure remote administration interface. 34 34 00:01:17,130 --> 00:01:20,070 SSH has pretty much replaced Telnet in most cases, 35 35 00:01:20,070 --> 00:01:21,960 and Telnet is extremely vulnerable. 36 36 00:01:21,960 --> 00:01:22,980 If you see that you're running 37 37 00:01:22,980 --> 00:01:24,750 a Telnet server on your system, 38 38 00:01:24,750 --> 00:01:27,420 you probably should look at upgrading it into an SSH server 39 39 00:01:27,420 --> 00:01:28,830 and getting rid of TELNET. 40 40 00:01:28,830 --> 00:01:30,810 25 is SMTP. 41 41 00:01:30,810 --> 00:01:33,330 It is the Simple Mail Transfer Protocol. 42 42 00:01:33,330 --> 00:01:35,760 This allows your email servers to send mail, 43 43 00:01:35,760 --> 00:01:37,650 and so port 25 will be open 44 44 00:01:37,650 --> 00:01:39,060 if you're running an email server 45 45 00:01:39,060 --> 00:01:40,620 that can send outbound mail. 46 46 00:01:40,620 --> 00:01:45,240 Port 53, DNS. DNS is the Domain Name System. 47 47 00:01:45,240 --> 00:01:49,500 Now, DNS translates our IPs to names and our names to IPs. 48 48 00:01:49,500 --> 00:01:51,480 Now, one of the unique things about DNS 49 49 00:01:51,480 --> 00:01:55,860 is DNS is port 53 on both TCP and UDP. 50 50 00:01:55,860 --> 00:01:58,560 In the next lesson, we're going to go through the UDP ports. 51 51 00:01:58,560 --> 00:02:01,590 But for right now, remember that 53 is DNS 52 52 00:02:01,590 --> 00:02:03,720 and when you're using it for TCP, 53 53 00:02:03,720 --> 00:02:06,060 it's going to be used for zone transfers. 54 54 00:02:06,060 --> 00:02:09,840 Next we have port 80, which is web traffic, HTTP, 55 55 00:02:09,840 --> 00:02:11,940 which is Hypertext Transfer Protocol. 56 56 00:02:11,940 --> 00:02:13,560 This is the unsecured version 57 57 00:02:13,560 --> 00:02:15,810 of being able to send data over the internet. 58 58 00:02:15,810 --> 00:02:18,390 So for example, if you go to diontraining.com 59 59 00:02:18,390 --> 00:02:20,790 and you're using the HTTP version, 60 60 00:02:20,790 --> 00:02:23,550 you're going to get an unencrypted version of my site. 61 61 00:02:23,550 --> 00:02:25,860 Next, we have 110, and this is POP3. 62 62 00:02:27,060 --> 00:02:29,640 POP3 is the Post Office Protocol version 3, 63 63 00:02:29,640 --> 00:02:32,490 and this is a legacy Mailbox Access Protocol. 64 64 00:02:32,490 --> 00:02:35,640 These days, POP3 has been replaced mostly with IMAP, 65 65 00:02:35,640 --> 00:02:36,870 which we'll talk about later. 66 66 00:02:36,870 --> 00:02:40,350 Port 111, this is RPCBIND. 67 67 00:02:40,350 --> 00:02:43,710 This is going to map the Remote Procedure Call, or RPC, service 68 68 00:02:43,710 --> 00:02:46,920 to port numbers inside a UNIX-like environment. 69 69 00:02:46,920 --> 00:02:49,440 Now, anytime we talk about a UNIX-like environment, 70 70 00:02:49,440 --> 00:02:53,070 this is going to apply to Unix, Linux, and macOS X 71 71 00:02:53,070 --> 00:02:56,220 because all three of those are a UNIX-like environment. 72 72 00:02:56,220 --> 00:02:59,850 If you see port 111 open, this is usually a dead giveaway 73 73 00:02:59,850 --> 00:03:04,230 that a particular server is running Unix, Linux, or macOS X 74 74 00:03:04,230 --> 00:03:06,030 because Windows uses different ports 75 75 00:03:06,030 --> 00:03:07,680 when you're dealing with RPC. 76 76 00:03:07,680 --> 00:03:11,100 Speaking of windows and RPC, we have port 135. 77 77 00:03:11,100 --> 00:03:13,650 Port 135 is MSRPC. 78 78 00:03:13,650 --> 00:03:15,930 This advertises what RPC services, 79 79 00:03:15,930 --> 00:03:17,610 or Remote Procedure Call services 80 80 00:03:17,610 --> 00:03:19,860 are available within a Windows environment. 81 81 00:03:19,860 --> 00:03:23,820 Next, we have 139, which is NetBIOS- SSN. 82 82 00:03:23,820 --> 00:03:25,980 NetBIOS Session Service is going to support 83 83 00:03:25,980 --> 00:03:29,940 Windows file sharing with pre-Windows 2000 version hosts. 84 84 00:03:29,940 --> 00:03:32,370 Now, a lot of recent hosts will still use this 85 85 00:03:32,370 --> 00:03:34,230 because it is backwards compatible, 86 86 00:03:34,230 --> 00:03:36,810 so it is something that may be open on your Windows servers 87 87 00:03:36,810 --> 00:03:38,340 in your Windows domain. 88 88 00:03:38,340 --> 00:03:40,110 Note, there is a lot of vulnerabilities 89 89 00:03:40,110 --> 00:03:42,600 against this particular server and service 90 90 00:03:42,600 --> 00:03:44,280 so it is something that you'd want to shut down 91 91 00:03:44,280 --> 00:03:45,750 if you don't need it. 92 92 00:03:45,750 --> 00:03:49,350 Next we have IMAP, which is port 143. 93 93 00:03:49,350 --> 00:03:51,780 IMAP is the Internet Mail Access Protocol 94 94 00:03:51,780 --> 00:03:54,000 and it is a newer version of mail access 95 95 00:03:54,000 --> 00:03:56,640 that has replaced POP3 in most systems. 96 96 00:03:56,640 --> 00:03:59,400 Port 443 is HTTPS, 97 97 00:03:59,400 --> 00:04:02,190 which is Hypertext Transfer Protocol Secure. 98 98 00:04:02,190 --> 00:04:04,920 If you're going to my website at diontraining.com 99 99 00:04:04,920 --> 00:04:06,300 and you're going to log in, 100 100 00:04:06,300 --> 00:04:07,890 you want to make sure that in the header, 101 101 00:04:07,890 --> 00:04:12,360 it says https://diontraining.com. 102 102 00:04:12,360 --> 00:04:14,430 This way, you create an encrypted tunnel 103 103 00:04:14,430 --> 00:04:16,410 between your client and my server 104 104 00:04:16,410 --> 00:04:18,030 when you're setting your usernames and passwords 105 105 00:04:18,030 --> 00:04:19,020 back and forth. 106 106 00:04:19,020 --> 00:04:21,780 If you see the lock or the green bar on your title bar 107 107 00:04:21,780 --> 00:04:22,860 when you type in your address, 108 108 00:04:22,860 --> 00:04:26,820 that means you're using a secure connection over port 443. 109 109 00:04:26,820 --> 00:04:31,560 The next port is port 445, and this is Microsoft-DS. 110 110 00:04:31,560 --> 00:04:33,420 This supports Windows file sharing 111 111 00:04:33,420 --> 00:04:36,360 using Server Message Block over TCP/IP 112 112 00:04:36,360 --> 00:04:38,220 on current Windows Networks. 113 113 00:04:38,220 --> 00:04:39,660 So if you're running Windows 10 114 114 00:04:39,660 --> 00:04:41,190 and you're doing Windows file sharing, 115 115 00:04:41,190 --> 00:04:43,050 you're using port 445. 116 116 00:04:43,050 --> 00:04:46,290 Next, we have IMAPS, which is the secure version 117 117 00:04:46,290 --> 00:04:48,270 of Internet Mail Access Protocol. 118 118 00:04:48,270 --> 00:04:50,850 This runs over port 993. 119 119 00:04:50,850 --> 00:04:53,490 Similarly, we have a secure version for POP3. 120 120 00:04:53,490 --> 00:04:57,390 This is Port 995, also known as POP3S. 121 121 00:04:57,390 --> 00:05:00,150 This is Post Office Protocol version 3 Secure. 122 122 00:05:00,150 --> 00:05:01,710 And essentially, with both of these, 123 123 00:05:01,710 --> 00:05:04,440 we're going to have a SSL or TLS tunnel created 124 124 00:05:04,440 --> 00:05:07,050 between our client and the server We're trying to reach, 125 125 00:05:07,050 --> 00:05:10,530 very much like HTTP versus HTTPS. 126 126 00:05:10,530 --> 00:05:15,030 The next one we have is port 1723, which is PPTP, 127 127 00:05:15,030 --> 00:05:17,220 the Point To Point Tunneling Protocol. 128 128 00:05:17,220 --> 00:05:20,280 This is a legacy VPN protocol that was used early on, 129 129 00:05:20,280 --> 00:05:22,770 but it does have a weak security implementation 130 130 00:05:22,770 --> 00:05:24,660 so we don't really use it very often these days. 131 131 00:05:24,660 --> 00:05:27,930 Instead, we've moved to more secure things like IPSec. 132 132 00:05:27,930 --> 00:05:31,200 The next port we're going to talk about is for MySQL servers. 133 133 00:05:31,200 --> 00:05:33,330 This is 3306. 134 134 00:05:33,330 --> 00:05:36,690 3306 is used for a MySQL database connection. 135 135 00:05:36,690 --> 00:05:38,220 So if you're creating a web application 136 136 00:05:38,220 --> 00:05:40,770 that can read and write to a MySQL database server, 137 137 00:05:40,770 --> 00:05:43,500 it's going to do this over report 3306. 138 138 00:05:43,500 --> 00:05:46,890 The next port we have is 3389, which is RDP, 139 139 00:05:46,890 --> 00:05:48,960 or the Remote Desktop Protocol. 140 140 00:05:48,960 --> 00:05:52,080 This will allow you to visually log into a remote system. 141 141 00:05:52,080 --> 00:05:53,850 You'll be able to see what the screen has, 142 142 00:05:53,850 --> 00:05:56,610 send keyboard and mouse commands back and forth. 143 143 00:05:56,610 --> 00:05:58,440 And that way, way you'll be able to control a system 144 144 00:05:58,440 --> 00:06:00,990 from a distance without having to use the command prompt. 145 145 00:06:00,990 --> 00:06:03,480 RDP is heavily used in a Windows environment. 146 146 00:06:03,480 --> 00:06:07,140 Next, we have port 5900, which is VNC, 147 147 00:06:07,140 --> 00:06:08,910 which is the Virtual Network Computing 148 148 00:06:08,910 --> 00:06:10,350 remote access service. 149 149 00:06:10,350 --> 00:06:12,780 This service is basically like RDP, 150 150 00:06:12,780 --> 00:06:15,840 but it is open source and used across all systems, 151 151 00:06:15,840 --> 00:06:17,070 not just Windows. 152 152 00:06:17,070 --> 00:06:19,830 Now, when you're using security with VNC, 153 153 00:06:19,830 --> 00:06:21,180 you may be using different ports 154 154 00:06:21,180 --> 00:06:22,980 depending on the configuration you're using, 155 155 00:06:22,980 --> 00:06:26,430 but port 5900 is the default port for VNC 156 156 00:06:26,430 --> 00:06:28,680 regardless of which security implementation you're using. 157 157 00:06:28,680 --> 00:06:30,630 And then based on the security implementation you're using, 158 158 00:06:30,630 --> 00:06:31,860 it may change that port. 159 159 00:06:31,860 --> 00:06:36,570 The last port we have is port 8080, which is HTTP-PROXY. 160 160 00:06:36,570 --> 00:06:38,370 This is a web proxy service 161 161 00:06:38,370 --> 00:06:41,190 or alternate port that can be used for HTTP. 162 162 00:06:41,190 --> 00:06:43,980 If I'm running two web servers on one server, 163 163 00:06:43,980 --> 00:06:45,720 I might have port 80 for the first one 164 164 00:06:45,720 --> 00:06:47,640 and port 8080 for the second one. 165 165 00:06:47,640 --> 00:06:49,590 Or if I'm running a proxy server, 166 166 00:06:49,590 --> 00:06:52,380 I can use Port 8080 to run that proxy server. 167 167 00:06:52,380 --> 00:06:56,100 Now, for the exam, do you have to memorize these ports? 168 168 00:06:56,100 --> 00:06:57,480 I would say yes. 169 169 00:06:57,480 --> 00:06:59,167 Now, are they going to ask you a question like, 170 170 00:06:59,167 --> 00:07:00,660 "What is port 8080?" 171 171 00:07:00,660 --> 00:07:02,790 The answer is no, they're not. 172 172 00:07:02,790 --> 00:07:04,080 Instead, as you're going through 173 173 00:07:04,080 --> 00:07:05,610 and doing your packet analysis, 174 174 00:07:05,610 --> 00:07:08,220 or you're looking over firewall log configurations, 175 175 00:07:08,220 --> 00:07:09,600 or anything like that, 176 176 00:07:09,600 --> 00:07:12,270 you're going to see port numbers all over the place. 177 177 00:07:12,270 --> 00:07:14,100 And a lot of times, they're not going to tell you 178 178 00:07:14,100 --> 00:07:15,750 what that port is used for. 179 179 00:07:15,750 --> 00:07:19,110 So if I'm looking at a packet capture and I see 3389, 180 180 00:07:19,110 --> 00:07:22,260 they're not going to say 3389 parenthesis RDP. 181 181 00:07:22,260 --> 00:07:24,300 It'll just say port 3389. 182 182 00:07:24,300 --> 00:07:26,280 And then you have to know that that is RDP, 183 183 00:07:26,280 --> 00:07:28,080 which means somebody might be remotely connecting 184 184 00:07:28,080 --> 00:07:30,330 to your server and controlling it from a distance. 185 185 00:07:30,330 --> 00:07:31,890 If that's coming from outside on the internet 186 186 00:07:31,890 --> 00:07:33,120 from some unknown IP, 187 187 00:07:33,120 --> 00:07:35,040 that could be an indicator of compromise. 188 188 00:07:35,040 --> 00:07:37,200 So that's the idea that you have to think about 189 189 00:07:37,200 --> 00:07:39,390 when you're dealing with these different port numbers. 190 190 00:07:39,390 --> 00:07:42,720 In this lesson, all the ports I just gave you are TCP. 191 191 00:07:42,720 --> 00:07:44,880 They are Transmission Control Protocol. 192 192 00:07:44,880 --> 00:07:46,470 They use a three-way handshake. 193 193 00:07:46,470 --> 00:07:49,470 They have resubmission of data if the data doesn't get there 194 194 00:07:49,470 --> 00:07:51,570 because of the way TCP works. 195 195 00:07:51,570 --> 00:07:54,273 In the next lesson, we're going to talk about UDP ports.