Instructor: Transmission Control Protocol Ports. 2 2
Now, as a cybersecurity analyst, 3 3
you have to know some TCP port numbers 4 4
for the different registered ports 5 5
that are commonly scanned against. 6 6
This way as you're going through your logs, 7 7
you don't have to keep looking them up each time. 8 8
If you see a port like port 80, 9 9
you should know that's web traffic. 10 10
It's HTTP, for instance. 11 11
In this lesson, I'm going to go through 12 12
the most common ports that you need to know for the exam. 13 13
We're going to go through them fairly quickly 14 14
because these are all things you should know already 15 15
from your previous studies in Security+, Network+, or A+. 16 16
If there's any of these that you don't understand, 17 17
make a note of it, go on to Google, 18 18
and look it up so you can understand 19 19
what that service is and what it's used for. 20 20
First, we have 21, which is FTP. 21 21
This is the File Transfer Protocol. 22 22
This is used, as you could guess, to transfer files. 23 23
Essentially, if you're running an FTP server, 24 24
port 21 would be open on your firewall. 25 25
Next, we have port 22, which is SSH or SFTP. 26 26
SSH is Secure Shell. 27 27
It is remote access tool to give you command line access 28 28
over a remote system. 29 29
Now, when you're dealing with SFTP, this is FTP over SSH, 30 30
which allows you to take File Transfer Protocol 31 31
and run it securely through an SSH secure tunnel. 32 32
Then we have port 23, Telnet. 33 33
Telnet is an unsecure remote administration interface. 34 34
SSH has pretty much replaced Telnet in most cases, 35 35
and Telnet is extremely vulnerable. 36 36
If you see that you're running 37 37
a Telnet server on your system, 38 38
you probably should look at upgrading it into an SSH server 39 39
and getting rid of TELNET. 40 40
25 is SMTP. 41 41
It is the Simple Mail Transfer Protocol. 42 42
This allows your email servers to send mail, 43 43
and so port 25 will be open 44 44
if you're running an email server 45 45
that can send outbound mail. 46 46
Port 53, DNS. DNS is the Domain Name System. 47 47
Now, DNS translates our IPs to names and our names to IPs. 48 48
Now, one of the unique things about DNS 49 49
is DNS is port 53 on both TCP and UDP. 50 50
In the next lesson, we're going to go through the UDP ports. 51 51
But for right now, remember that 53 is DNS 52 52
and when you're using it for TCP, 53 53
it's going to be used for zone transfers. 54 54
Next we have port 80, which is web traffic, HTTP, 55 55
which is Hypertext Transfer Protocol. 56 56
This is the unsecured version 57 57
of being able to send data over the internet. 58 58
So for example, if you go to diontraining.com 59 59
and you're using the HTTP version, 60 60
you're going to get an unencrypted version of my site. 61 61
Next, we have 110, and this is POP3. 62 62
POP3 is the Post Office Protocol version 3, 63 63
and this is a legacy Mailbox Access Protocol. 64 64
These days, POP3 has been replaced mostly with IMAP, 65 65
which we'll talk about later. 66 66
Port 111, this is RPCBIND. 67 67
This is going to map the Remote Procedure Call, or RPC, service 68 68
to port numbers inside a UNIX-like environment. 69 69
Now, anytime we talk about a UNIX-like environment, 70 70
this is going to apply to Unix, Linux, and macOS X 71 71
because all three of those are a UNIX-like environment. 72 72
If you see port 111 open, this is usually a dead giveaway 73 73
that a particular server is running Unix, Linux, or macOS X 74 74
because Windows uses different ports 75 75
when you're dealing with RPC. 76 76
Speaking of windows and RPC, we have port 135. 77 77
Port 135 is MSRPC. 78 78
This advertises what RPC services, 79 79
or Remote Procedure Call services 80 80
are available within a Windows environment. 81 81
Next, we have 139, which is NetBIOS- SSN. 82 82
NetBIOS Session Service is going to support 83 83
Windows file sharing with pre-Windows 2000 version hosts. 84 84
Now, a lot of recent hosts will still use this 85 85
because it is backwards compatible, 86 86
so it is something that may be open on your Windows servers 87 87
in your Windows domain. 88 88
Note, there is a lot of vulnerabilities 89 89
against this particular server and service 90 90
so it is something that you'd want to shut down 91 91
if you don't need it. 92 92
Next we have IMAP, which is port 143. 93 93
IMAP is the Internet Mail Access Protocol 94 94
and it is a newer version of mail access 95 95
that has replaced POP3 in most systems. 96 96
Port 443 is HTTPS, 97 97
which is Hypertext Transfer Protocol Secure. 98 98
If you're going to my website at diontraining.com 99 99
and you're going to log in, 100 100
you want to make sure that in the header, 101 101
it says https://diontraining.com. 102 102
This way, you create an encrypted tunnel 103 103
between your client and my server 104 104
when you're setting your usernames and passwords 105 105
back and forth. 106 106
If you see the lock or the green bar on your title bar 107 107
when you type in your address, 108 108
that means you're using a secure connection over port 443. 109 109
The next port is port 445, and this is Microsoft-DS. 110 110
This supports Windows file sharing 111 111
using Server Message Block over TCP/IP 112 112
on current Windows Networks. 113 113
So if you're running Windows 10 114 114
and you're doing Windows file sharing, 115 115
you're using port 445. 116 116
Next, we have IMAPS, which is the secure version 117 117
of Internet Mail Access Protocol. 118 118
This runs over port 993. 119 119
Similarly, we have a secure version for POP3. 120 120
This is Port 995, also known as POP3S. 121 121
This is Post Office Protocol version 3 Secure. 122 122
And essentially, with both of these, 123 123
we're going to have a SSL or TLS tunnel created 124 124
between our client and the server We're trying to reach, 125 125
very much like HTTP versus HTTPS. 126 126
The next one we have is port 1723, which is PPTP, 127 127
the Point To Point Tunneling Protocol. 128 128
This is a legacy VPN protocol that was used early on, 129 129
but it does have a weak security implementation 130 130
so we don't really use it very often these days. 131 131
Instead, we've moved to more secure things like IPSec. 132 132
The next port we're going to talk about is for MySQL servers. 133 133
This is 3306. 134 134
3306 is used for a MySQL database connection. 135 135
So if you're creating a web application 136 136
that can read and write to a MySQL database server, 137 137
it's going to do this over report 3306. 138 138
The next port we have is 3389, which is RDP, 139 139
or the Remote Desktop Protocol. 140 140
This will allow you to visually log into a remote system. 141 141
You'll be able to see what the screen has, 142 142
send keyboard and mouse commands back and forth. 143 143
And that way, way you'll be able to control a system 144 144
from a distance without having to use the command prompt. 145 145
RDP is heavily used in a Windows environment. 146 146
Next, we have port 5900, which is VNC, 147 147
which is the Virtual Network Computing 148 148
remote access service. 149 149
This service is basically like RDP, 150 150
but it is open source and used across all systems, 151 151
not just Windows. 152 152
Now, when you're using security with VNC, 153 153
you may be using different ports 154 154
depending on the configuration you're using, 155 155
but port 5900 is the default port for VNC 156 156
regardless of which security implementation you're using. 157 157
And then based on the security implementation you're using, 158 158
it may change that port. 159 159
The last port we have is port 8080, which is HTTP-PROXY. 160 160
This is a web proxy service 161 161
or alternate port that can be used for HTTP. 162 162
If I'm running two web servers on one server, 163 163
I might have port 80 for the first one 164 164
and port 8080 for the second one. 165 165
Or if I'm running a proxy server, 166 166
I can use Port 8080 to run that proxy server. 167 167
Now, for the exam, do you have to memorize these ports? 168 168
I would say yes. 169 169
Now, are they going to ask you a question like, 170 170
"What is port 8080?" 171 171
The answer is no, they're not. 172 172
Instead, as you're going through 173 173
and doing your packet analysis, 174 174
or you're looking over firewall log configurations, 175 175
or anything like that, 176 176
you're going to see port numbers all over the place. 177 177
And a lot of times, they're not going to tell you 178 178
what that port is used for. 179 179
So if I'm looking at a packet capture and I see 3389, 180 180
they're not going to say 3389 parenthesis RDP. 181 181
It'll just say port 3389. 182 182
And then you have to know that that is RDP, 183 183
which means somebody might be remotely connecting 184 184
to your server and controlling it from a distance. 185 185
If that's coming from outside on the internet 186 186
from some unknown IP, 187 187
that could be an indicator of compromise. 188 188
So that's the idea that you have to think about 189 189
when you're dealing with these different port numbers. 190 190
In this lesson, all the ports I just gave you are TCP. 191 191
They are Transmission Control Protocol. 192 192
They use a three-way handshake. 193 193
They have resubmission of data if the data doesn't get there 194 194
because of the way TCP works. 195 195
In the next lesson, we're going to talk about UDP ports.