ADB (Android Debug Bridge)
The Android Debug Bridge (ADB) is a command-line tool that allows communication with an Android device. If not configured properly, it can be exploited to access sensitive data or even full command of the device.
Artifact Registry
Artifact registries store container images, packages, Helm charts, build outputs, and release files. In pentests, exposed registries can leak private images, packages, source archives, CI tokens, secrets in layers, and write paths for supply-chain abuse.
Consul
HashiCorp Consul provides service discovery, health checks, DNS, and a key-value store. In pentests, exposed Consul can leak services, internal hosts, KV secrets, ACL tokens, and network topology.
DHCP (Dynamic Host Configuration Protocol)
DHCP assigns IP addresses, gateways, DNS servers, domain names, and other network options to clients. In internal pentests, DHCP testing can expose rogue servers, weak network controls, WPAD redirection risk, and useful network configuration.
Docker API
Docker is a containerization platform that allows developers to package applications and their dependencies into isolated containers. The Docker API provides remote management capabilities, enabling administration of Docker hosts over the network. When exposed without proper authentication, it can lead to complete host compromise.
DomainNameSystem
DNS (Domain Name System) functions as the internet's phonebook, converting user-friendly domain names like hackviser.com into numerical IP addresses, enabling swift access to online resources. DNS is a hierarchical and decentralized naming system for computers, services, or any resource connected to the Internet or a private network. It translates human-readable domain names to numerical IP addresses, essential for locating and identifying computer services and devices within network protocols.
ElasticSearch
Elasticsearch is a distributed, RESTful search and analytics engine built on Apache Lucene. It's designed for horizontal scalability, real-time search, and complex data analysis. Elasticsearch stores data in JSON format and provides powerful full-text search capabilities. It's commonly used for log analytics (ELK stack), application search, security analytics, and business intelligence. Due to its RESTful API and potential misconfigurations, Elasticsearch instances can expose sensitive data if not properly secured.
Grafana
Grafana is an open-source analytics and interactive visualization web application. It provides charts, graphs, and alerts when connected to supported data sources such as Prometheus, Elasticsearch, InfluxDB, and many others. Grafana is extremely popular in DevOps environments for monitoring infrastructure, applications, and business metrics. Misconfigurations can expose sensitive metrics, datasource credentials, and provide paths to compromise the underlying infrastructure.
ICMP [Intermet control message ptotocol]
ICMP (Internet Control Message Protocol) is a network layer protocol used by network devices, including routers, to send error messages and operational information indicating success or failure when communicating with another IP address. It is commonly used for diagnostics and troubleshooting in IP networks.
IMAP (Internet Message Access Protocol)
nternet Message Access Protocol (IMAP) is a standard email protocol that stores email messages on a mail server and allows the end user to view and manipulate them as though they were stored locally on their device. Unlike POP3, IMAP synchronizes email across multiple devices and allows management of email directly on the server.
IPP, CUPS and JetDirect
IPP, CUPS, and JetDirect are printing protocols and services used by printers, print servers, and Linux/macOS print systems. In pentests, exposed print services can leak device info, jobs, usernames, internal names, and sometimes allow unauthenticated print or admin actions.
IRC Pentesting
IRC (Internet Relay Chat), is a protocol and communication system that allows users to engage in real-time text-based conversations. In this article, we will examine the pentesting techniques for IRC.
ISCSI Pentesting
ISCSI (Internet Small Computer System Interface) is a protocol used for establishing and managing connections between storage devices over an IP network. It enables storage devices to be shared and accessed remotely, providing block-level access to storage resources.
Java RMI, JMX and JDWP
Java RMI, JMX, and JDWP expose Java remote objects, management operations, and debugging interfaces. In pentests, unauthenticated Java management ports can reveal runtime data, MBeans, system properties, credentials, and sometimes code execution paths.
Jenkins
Jenkins is an open-source automation server widely used for continuous integration and continuous delivery (CI/CD). It automates building, testing, and deploying applications. Due to its powerful features including script execution and plugin ecosystem, Jenkins is a high-value target that can lead to complete infrastructure compromise.
Apache Kafka
Default Ports: 9092 (Broker), 9093 (SSL), 2181 (Zookeeper)
Kerberos
Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications using secret-key cryptography. Developed by MIT, it's the default authentication protocol in Windows Active Directory environments. Kerberos uses tickets to allow nodes to prove their identity over non-secure networks without transmitting passwords. The protocol involves a Key Distribution Center (KDC) that includes an Authentication Server (AS) and a Ticket Granting Server (TGS).
Kibana
Kibana is an open-source data visualization and exploration tool used for log and time-series analytics. It provides powerful and beautiful dashboards for real-time visualization of data in Elasticsearch.
Kubernetes API
Kubernetes is an open-source container orchestration platform that automates deploying, scaling, and managing containerized applications. Originally developed by Google, it's now the industry standard for container orchestration. Kubernetes exposes multiple APIs that, if misconfigured, can lead to complete cluster compromise, access to sensitive secrets, and lateral movement across the entire infrastructure.
LDAP (Lightweight Directory Access Protocol)
Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an IP network. LDAP is commonly used for user authentication, authorization, and storing organizational information. Microsoft's Active Directory is built on LDAP. LDAP directories store information hierarchically in a tree structure.
LLMNR, mDNS and NBNS
LLMNR, mDNS, and NBNS are local name resolution protocols used when DNS does not answer. In internal pentests, they are common paths for name poisoning, NTLM capture, relay setup, and local service discovery.
LPD Pentesting
LPD (Line Printer Daemon), is a protocol used to manage and process print jobs on Unix-based systems. While it is primarily used for printing purposes, it can sometimes be misconfigured, allowing for potential security vulnerabilities. In this article, we will explore pentesting techniques for LPD, categorized under the following headings: Connect, Recon, Enumeration, Attack Vectors, and Post-Exploitation.
MODBUS
Modbus is a communication protocol used extensively in industrial environments to facilitate communication between electronic devices. It allows control systems, such as PLCs (Programmable Logic Controllers), to communicate data over serial lines or TCP/IP networks.
MQTT
MQTT is a lightweight publish/subscribe protocol used in IoT, telemetry, mobile apps, and microservices. In pentests, MQTT often exposes anonymous access, broad topic permissions, retained messages, and sensitive device or command traffic.
MSRPC (Microsoft Remote Procedure Call)
MSRPC (Microsoft Remote Procedure Call) is the modified version of DCE/RPC. It forms the basis of network-level service interoperability. MSRPC is the protocol standard for Windows processes that allows a program running on one host to execute a program on another host.
MSSQL (Microsoft SQL Server)
Microsoft SQL Server (MSSQL) is a relational database management system developed by Microsoft. It's widely used in enterprise environments and integrates tightly with Windows infrastructure. MSSQL offers powerful features including stored procedures, xp_cmdshell for command execution, and extensive Windows authentication integration.
Memcached
Memcached is a high-performance, distributed memory caching system designed to speed up dynamic web applications by alleviating database load. It stores data in RAM as key-value pairs for quick retrieval. While primarily used for caching, memcached can store session data, API responses, and other temporary information. Misconfigured memcached instances can expose sensitive data and be exploited for denial of service or data manipulation.
MinIO and S3-Compatible Storage
MinIO and S3-compatible storage services store objects inside buckets. In pentests, misconfigured buckets can expose backups, uploads, logs, CI artifacts, static files, model files, and secrets.
MySQL
MySQL is an open source relational database management system (RDBMS) widely used worldwide. Databases are used to store and manage interrelated data. MySQL is a preferred solution in many areas such as web-based applications, data storage, e-commerce, and log records. SQL (Structured Query Language) is the language MySQL uses to communicate with the database.
NFS
NetBIOS
NetBIOS (Network Basic Input/Output System) is a network protocol that allows applications on different computers to communicate within a local area network (LAN). It provides services for name resolution, session management, and datagram distribution. NetBIOS is commonly used in Windows networks and often runs alongside SMB. While largely replaced by modern protocols, NetBIOS is still found in many Windows environments.
Oracle Database
Oracle Database is a multi-model database management system produced and marketed by Oracle Corporation. It's one of the most widely used enterprise relational database management systems, particularly in large corporations and government organizations. Oracle Database offers advanced features including stored procedures, triggers, and the ability to execute Java code within the database. Due to its complexity and enterprise deployment, Oracle databases often contain highly sensitive data and can be challenging to secure properly.
POP3 (Post Office Protocol)
Post Office Protocol version 3 (POP3) is an email protocol used to retrieve emails from a remote server to a local client. Unlike IMAP, POP3 typically downloads emails to the client and deletes them from the server (though this can be configured). POP3 is simpler than IMAP but less feature-rich, primarily designed for offline email access.
PostgreSQL
PostgreSQL, also known as Postgres, is a powerful open-source object-relational database management system (ORDBMS). It emphasizes extensibility and SQL compliance, supporting both SQL (relational) and JSON (non-relational) querying. PostgreSQL is known for its robust feature set, reliability, data integrity, and strong community support. It's widely used in web applications, data warehousing, and as a backend for various enterprise applications.
Prometheus, Alertmanager and Exporters
Prometheus collects metrics, Alertmanager routes alerts, and exporters expose host or application metrics. In pentests, monitoring endpoints can leak internal targets, hostnames, cloud labels, Kubernetes metadata, URLs, credentials in labels, and operational alerts.
RADIUS
RADIUS is an AAA protocol used by VPNs, Wi-Fi, NAC, firewalls, routers, and MFA gateways. In pentests, RADIUS testing focuses on exposed servers, weak shared secrets, accepted client IPs, credential validation, and legacy EAP behavior.
RDP (Remote Desktop Protocol)
Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft that provides a graphical interface for users to connect to another computer over a network connection. RDP is widely used for remote administration, technical support, and accessing work computers from home. It transmits keyboard, mouse, and display data between client and server, making it a critical service in Windows environments.
RSH Pentesting
RSH (Remote Shell), is a protocol that allows users to execute shell commands on a remote machine. In this article, we will examine the pentesting techniques for RSH under the following categories: Connect, Recon, Enumeration, Attack Vectors, and Post-Exploitation.
RabbitMQ
RabbitMQ is an open-source message broker software that implements the Advanced Message Queuing Protocol (AMQP). It facilitates communication between distributed applications by routing and queuing messages. RabbitMQ is widely used in microservices architectures and can expose sensitive data if misconfigured.
Rpcbind
rpcbind maps ONC RPC program numbers to the network addresses where their services are listening. Clients query rpcbind on TCP or UDP port 111 to locate programs such as NFS and mountd, which may use dynamically assigned ports.
Rsync
Connect
SIP and VoIP
SIP is used by VoIP phones, PBXs, trunks, and call platforms. In pentests, SIP can expose extensions, weak phone credentials, call routing abuse, voicemail access, and PBX management weaknesses.
SMB (Server Message Block)
SMB (Server Message Block), also known as CIFS (Common Internet File System), is a network protocol that allows for file sharing, network browsing, printing services, and inter-process communication over a network.
SMTP (Simple Mail Transfer Protocol)
Simple Mail Transfer Protocol (SMTP) is an internet standard communication protocol for electronic mail transmission. SMTP is a text-based protocol where one or more recipients of a message are specified, and then the message text is transferred. It operates on a push model, where the sending mail server pushes messages to receiving mail servers. SMTP is crucial for email communication infrastructure and can be exploited for phishing, spam, and information disclosure.
AD CS (Active Directory Certificate Services)
Active Directory Certificate Services (AD CS) issues certificates in Windows domains. In pentests, AD CS misconfigurations can allow certificate-based privilege escalation, account impersonation, NTLM relay, and long-lived domain persistence.
etcd
etcd is a distributed, reliable key-value store for the most critical data of a distributed system. It's used for shared configuration, service discovery, and coordinator election in distributed systems. Most notably, etcd is the primary datastore for Kubernetes, storing all cluster state, secrets, and configuration. Compromising etcd means complete access to all Kubernetes secrets, certificates, and cluster configuration - making it one of the highest value targets in cloud-native environments.
gRPC
gRPC is an RPC framework commonly used for microservices, mobile backends, service meshes, and internal APIs. gRPC pentesting focuses on reflection, protobuf schemas, metadata headers, authentication, authorization, and HTTP/2 gateway behavior.
HTTP/HTTPS[WebServer]
HTTP (Hypertext Transfer Protocol) and HTTPS (HTTP Secure) are the foundation protocols of the World Wide Web. They enable communication between web clients and servers. HTTP operates on port 80 by default, while HTTPS uses SSL/TLS encryption and operates on port 443. Alternative ports like 8080, 8443, and others are commonly used for development, proxies, or secondary web services.
MongoDB
Default Ports: 27017, 27018
AD CS (Active Directory Certificate Services)
Active Directory Certificate Services (AD CS) issues certificates in Windows domains. In pentests, AD CS misconfigurations can allow certificate-based privilege escalation, account impersonation, NTLM relay, and long-lived domain persistence.