~/tools $ ./ports --lookup

Port Reference

Searchable list of common ports with what each service is and what to check first when you find it open.

Runs entirely in your browser. Nothing you paste is sent anywhere.

Search by number, service, or keyword

Port	Service	What to check
`20/tcp`	FTP data	Active-mode FTP data channel.
`21/tcp`	FTP	Check for anonymous login and cleartext credentials. nmap -sC runs ftp-anon.
`22/tcp`	SSH	Banner reveals OpenSSH version and often the OS. Look for password auth and weak keys.
`23/tcp`	Telnet	Cleartext everything. Common on network gear and IoT with default credentials.
`25/tcp`	SMTP	VRFY and EXPN can enumerate users. Test for open relay only with permission.
`53/tcp/udp`	DNS	TCP 53 open to the internet may allow zone transfers (dig axfr).
`67/udp`	DHCP server	Rogue DHCP is a classic internal network attack.
`69/udp`	TFTP	No authentication. Often holds router configs and PXE boot images.
`80/tcp`	HTTP	Start web enumeration: tech fingerprinting, content discovery, vhosts.
`88/tcp/udp`	Kerberos	Signals a domain controller. Enables user enumeration, AS-REP roasting, and Kerberoasting.
`110/tcp`	POP3	Cleartext mail retrieval unless STARTTLS is used.
`111/tcp/udp`	RPCbind	rpcinfo -p lists RPC services. Often leads to NFS.
`119/tcp`	NNTP	Usenet news. Rare, but sometimes left open on old hosts.
`123/udp`	NTP	Clock source. Kerberos breaks with more than five minutes of skew.
`135/tcp`	MS RPC endpoint mapper	Windows host. rpcdump and rpcclient enumerate interfaces.
`137/udp`	NetBIOS name	nbtscan reveals hostnames, domain, and logged-on users.
`138/udp`	NetBIOS datagram	Legacy Windows browsing.
`139/tcp`	NetBIOS session (SMB)	SMB over NetBIOS. Enumerate the same way as 445.
`143/tcp`	IMAP	Mail retrieval. Credential reuse target.
`161/udp`	SNMP	Try community strings public and private. snmpwalk can dump processes, users, and routes.
`162/udp`	SNMP trap	Receives alerts from devices.
`179/tcp`	BGP	Internet routing. Should never be reachable from arbitrary hosts.
`389/tcp/udp`	LDAP	Anonymous binds can dump users, groups, and descriptions with passwords in them.
`443/tcp`	HTTPS	Read the certificate for hostnames, then enumerate like HTTP.
`445/tcp`	SMB	Null sessions, readable shares, signing disabled (relay), and historic bugs like MS17-010.
`464/tcp/udp`	Kerberos password change	kpasswd. Another domain controller indicator.
`465/tcp`	SMTPS	SMTP over implicit TLS.
`500/udp`	IKE (IPsec VPN)	ike-scan fingerprints the VPN. Aggressive mode can leak a crackable hash.
`514/udp`	Syslog	Unauthenticated log ingestion. Also rsh on TCP 514.
`515/tcp`	LPD printing	Printers are frequently forgotten and unpatched.
`587/tcp`	SMTP submission	Authenticated mail submission. Password spraying target.
`593/tcp`	RPC over HTTP	Windows RPC endpoint mapper over HTTP.
`623/udp`	IPMI	Server management (BMC). IPMI 2.0 leaks password hashes by design (RAKP).
`631/tcp`	IPP / CUPS	Printing. CUPS has had remote vulnerabilities; check the version.
`636/tcp`	LDAPS	LDAP over TLS.
`873/tcp`	rsync	rsync --list-only rsync://host/ shows modules, sometimes with no auth.
`902/tcp`	VMware ESXi	VMware authentication daemon.
`993/tcp`	IMAPS	IMAP over TLS.
`995/tcp`	POP3S	POP3 over TLS.
`1080/tcp`	SOCKS proxy	An open proxy into the network is a serious finding.
`1194/udp`	OpenVPN	Default OpenVPN port.
`1433/tcp`	Microsoft SQL Server	Check for sa with a weak password and xp_cmdshell exposure.
`1434/udp`	MSSQL browser	Reveals instance names and ports.
`1521/tcp`	Oracle TNS	odat and tnscmd enumerate SIDs and default accounts.
`1723/tcp`	PPTP VPN	MS-CHAPv2 based. Considered broken.
`1883/tcp`	MQTT	IoT message broker. Often allows anonymous subscribe to #, which shows every topic.
`2049/tcp/udp`	NFS	showmount -e lists exports. no_root_squash is a privilege escalation.
`2375/tcp`	Docker API (no TLS)	Unauthenticated Docker daemon. Equivalent to root on the host.
`2376/tcp`	Docker API (TLS)	Should require client certificates.
`2379/tcp`	etcd	Kubernetes backing store. Unauthenticated access exposes every secret.
`3000/tcp`	Dev servers, Grafana	Node, Rails, and Grafana defaults. Grafana has admin:admin by default.
`3128/tcp`	Squid proxy	Open proxies can reach internal hosts.
`3268/tcp`	LDAP Global Catalog	Forest-wide AD queries.
`3306/tcp`	MySQL / MariaDB	Check for root with no password and remote access.
`3389/tcp`	RDP	nmap rdp-ntlm-info leaks hostname and domain. Check NLA and BlueKeep-era versions.
`3690/tcp`	Subversion	svn list can expose source code and history.
`4369/tcp`	Erlang port mapper	Seen with RabbitMQ and CouchDB. The Erlang cookie grants code execution.
`4444/tcp`	Common listener port	Metasploit's default. Seeing it open on a host is a red flag for compromise.
`5000/tcp`	Flask, Docker registry, UPnP	Many dev frameworks default here. macOS AirPlay too.
`5060/tcp/udp`	SIP	VoIP signaling. svmap and svwar enumerate extensions.
`5353/udp`	mDNS	Local service discovery. Leaks hostnames and device types.
`5432/tcp`	PostgreSQL	Check pg_hba.conf trust rules and default postgres account.
`5555/tcp`	Android ADB	Network ADB gives a shell on the device.
`5672/tcp`	AMQP (RabbitMQ)	guest:guest works from localhost by default.
`5900/tcp`	VNC	Check for no authentication. vnc-info shows the security types.
`5985/tcp`	WinRM (HTTP)	PowerShell remoting. evil-winrm with valid creds gives a shell.
`5986/tcp`	WinRM (HTTPS)	WinRM over TLS.
`6379/tcp`	Redis	Unauthenticated by default in old versions. Can write files to disk.
`6443/tcp`	Kubernetes API	Check anonymous auth and what system:anonymous can do.
`6667/tcp`	IRC	Also historically used for botnet command and control.
`7001/tcp`	Oracle WebLogic	Long history of deserialization RCE. Version matters.
`8000/tcp`	HTTP alternate	Django and Python http.server defaults.
`8080/tcp`	HTTP alternate / proxy	Tomcat, Jenkins, and proxies. Tomcat /manager with default creds is a classic.
`8081/tcp`	HTTP alternate	Nexus, McAfee, and various admin panels.
`8086/tcp`	InfluxDB	Time-series database, sometimes without auth.
`8443/tcp`	HTTPS alternate	Management interfaces for appliances and VPNs.
`8500/tcp`	Consul	HashiCorp Consul UI and API. Check ACLs.
`8888/tcp`	Jupyter Notebook	An unauthenticated notebook is remote code execution by design.
`9000/tcp`	PHP-FPM, Portainer, SonarQube	Exposed PHP-FPM can be abused directly.
`9090/tcp`	Prometheus, Cockpit	Metrics endpoints leak internal hostnames and versions.
`9100/tcp`	Raw printing (JetDirect)	PRET can talk PJL and PostScript to printers.
`9200/tcp`	Elasticsearch	GET /_cat/indices on an open cluster lists everything stored.
`9418/tcp`	Git protocol	git:// daemon, read-only and unauthenticated.
`10250/tcp`	Kubelet API	Anonymous kubelet access allows exec into pods.
`11211/tcp/udp`	Memcached	No auth. UDP memcached was a massive DDoS amplifier.
`15672/tcp`	RabbitMQ management	Web UI. Try guest:guest.
`27017/tcp`	MongoDB	Old defaults bound to all interfaces with no auth.
`47001/tcp`	WinRM listener	Local WinRM HTTP listener on Windows hosts.
`50000/tcp`	SAP, Jenkins agent	Jenkins JNLP agents and SAP services.

Ports are hints, not facts

A port number only says what usually listens there. Always confirm with service detection, for examplenmap -sV -p 8080 target, because admins move services and attackers hide them. Anything open that does not match the asset's purpose is worth a closer look.