02-03: Exercises¶
Question¶
You are reviewing a host's open ports during a security audit. For each port number below, identify:
- The service commonly associated with it
- The transport protocol (TCP/UDP)
- Whether it is insecure/risky by default, and why
Ports: 21, 22, 23, 25, 53, 80, 443, 3389, 49152, 8080
Solution¶
Work through each port using well-known IANA assignments (ports 0–1023 are "well-known," 1024–49151 are "registered," and 49152–65535 are "dynamic/ephemeral"):
Port 21 — FTP (File Transfer Protocol)¶
- Protocol: TCP
- Security note: Insecure. Sends credentials and data in plaintext. Should be replaced with FTPS or SFTP (port 22/990).
Port 22 — SSH (Secure Shell)¶
- Protocol: TCP
- Security note: Secure by design (encrypted). Still, risk comes from weak passwords or exposing it to the whole internet — restrict source IPs and prefer key-based auth.
Port 23 — Telnet¶
- Protocol: TCP
- Security note: Insecure. Plaintext remote login, including credentials. Should be disabled entirely and replaced with SSH.
Port 25 — SMTP (Simple Mail Transfer Protocol)¶
- Protocol: TCP
- Security note: Risky if unauthenticated/unencrypted. Plain SMTP has no built-in confidentiality; used for mail relay and can be abused for spam relay if misconfigured. Prefer SMTPS/STARTTLS (port 465/587).
Port 53 — DNS (Domain Name System)¶
- Protocol: UDP (queries/responses), TCP (zone transfers, large responses)
- Security note: Risky if left open to the world on a resolver — can be abused for DNS amplification DDoS attacks or cache poisoning. Should be restricted/rate-limited on public-facing servers.
Port 80 — HTTP¶
- Protocol: TCP
- Security note: Insecure. Traffic (including any submitted forms/cookies) travels in plaintext and can be intercepted or modified in transit. Should redirect to HTTPS (443).
Port 443 — HTTPS¶
- Protocol: TCP
- Security note: Secure by design (TLS-encrypted), assuming a valid, properly configured certificate and modern TLS version. Misconfigured TLS (old versions/weak ciphers) reduces this protection.
Port 3389 — RDP (Remote Desktop Protocol)¶
- Protocol: TCP
- Security note: High-risk if exposed to the internet. A frequent target for brute-force and ransomware campaigns. Should be placed behind a VPN, restricted by IP allowlist, or protected with MFA/Network Level Authentication.
Port 49152 — Dynamic/Ephemeral port¶
- Protocol: TCP or UDP (context-dependent)
- Security note: Not tied to a specific well-known service — this range is used for temporary client-side connections (e.g., the source port of an outbound request) or occasionally by an application at runtime. Not inherently insecure, but an unexpected listening service here should be investigated, since malware sometimes hides on high ephemeral ports.
Port 8080 — HTTP alternate (commonly used for proxies/web apps)¶
- Protocol: TCP
- Security note: Often used for web servers, proxies, or admin panels running without a privileged process (avoids needing port 80). Same risks as port 80 if unencrypted — plaintext traffic unless the app enforces TLS.
Final Answer¶
| Port | Service | Protocol | Security Note |
|---|---|---|---|
| 21 | FTP | TCP | Insecure — plaintext credentials/data |
| 22 | SSH | TCP | Secure by design — restrict exposure, use keys |
| 23 | Telnet | TCP | Insecure — plaintext login, avoid entirely |
| 25 | SMTP | TCP | Risky unencrypted — use STARTTLS/SMTPS |
| 53 | DNS | UDP/TCP | Risky if open resolver — amplification DDoS target |
| 80 | HTTP | TCP | Insecure — plaintext, redirect to HTTPS |
| 443 | HTTPS | TCP | Secure by design with valid TLS config |
| 3389 | RDP | TCP | High-risk if internet-facing — VPN/MFA recommended |
| 49152 | Ephemeral/dynamic | TCP/UDP | Not a fixed service — investigate unexpected listeners |
| 8080 | HTTP-alt (proxy/web app) | TCP | Same risk as port 80 unless TLS is enforced |