// HackTricks · CC BY-NC 4.0

Network Services

198 pages · adapted from upstream with source attribution on every page.

001 Network Services.NET SOAP/WSDL Client Proxy Abuse pentesting-web 002 Network Services10000/tcp - Network Data Management Protocol (NDMP) network-services-pentesting 003 Network Services1026 - Pentesting Rusersd network-services-pentesting 004 Network Services1080 - Pentesting Socks network-services-pentesting 005 Network Services1099 (legacy 1098/1050) - Pentesting Java RMI and RMI-IIOP network-services-pentesting 006 Network Services110,995 - Pentesting POP network-services-pentesting 007 Network Services111/TCP/UDP - Pentesting Portmapper network-services-pentesting 008 Network Services11211 - Pentesting Memcache 11211-memcache 009 Network Services113 - Pentesting Ident network-services-pentesting 010 Network Services123/udp - Pentesting NTP network-services-pentesting 011 Network Services12346/udp - Pentesting Cisco Catalyst SD-WAN Control Plane network-services-pentesting 012 Network Services135, 593 - Pentesting MSRPC network-services-pentesting 013 Network Services137,138,139 - Pentesting NetBios network-services-pentesting 014 Network Services139,445 - Pentesting SMB pentesting-smb 015 Network Services1414 - Pentesting IBM MQ network-services-pentesting 016 Network Services143,993 - Pentesting IMAP network-services-pentesting 017 Network Services1433 - Pentesting MSSQL - Microsoft SQL Server pentesting-mssql-microsoft-sql-server 018 Network Services1521, 1522-1529 - Pentesting Oracle TNS Listener network-services-pentesting 019 Network Services15672 - Pentesting RabbitMQ Management network-services-pentesting 020 Network Services161/udp, 162/udp, 10161-10162/tcp/udp - Pentesting SNMP pentesting-snmp 021 Network Services1723 - Pentesting PPTP network-services-pentesting 022 Network Services1883 - Pentesting MQTT (Mosquitto) network-services-pentesting 023 Network Services194,6667,6660-7000 - Pentesting IRC network-services-pentesting 024 Network Services2049 - Pentesting NFS Service network-services-pentesting 025 Network Services21 - Pentesting FTP pentesting-ftp 026 Network Services22 - Pentesting SSH/SFTP network-services-pentesting 027 Network Services23 - Pentesting Telnet network-services-pentesting 028 Network Services2301, 2381 - Pentesting Compaq/HP Insight Manager network-services-pentesting 029 Network Services2375, 2376 Pentesting Docker network-services-pentesting 030 Network Services24007-24008-24009-49152 - Pentesting GlusterFS network-services-pentesting 031 Network Services25, 465, 587 - Pentesting SMTP pentesting-smtp 032 Network Services264/tcp - Pentesting Check Point Firewall network-services-pentesting 033 Network Services27017,27018 - Pentesting MongoDB network-services-pentesting 034 Network Services3128/tcp - Pentesting Squid network-services-pentesting 035 Network Services32100/UDP - Pentesting PPPP (CS2) P2P Cameras network-services-pentesting 036 Network Services3260 - Pentesting iSCSI network-services-pentesting 037 Network Services3299/tcp - Pentesting SAProuter network-services-pentesting 038 Network Services3306 - Pentesting MySQL network-services-pentesting 039 Network Services3389 - Pentesting RDP network-services-pentesting 040 Network Services3632 - Pentesting Distcc network-services-pentesting 041 Network Services3690/tcp - Pentesting Subversion (SVN) Server network-services-pentesting 042 Network Services3702/UDP - Pentesting WS-Discovery network-services-pentesting 043 Network Services389, 636, 3268, 3269 - Pentesting LDAP network-services-pentesting 044 Network Services403 & 401 Bypasses pentesting-web 045 Network Services4222 - Pentesting NATS / JetStream network-services-pentesting 046 Network Services43 - Pentesting WHOIS network-services-pentesting 047 Network Services4369 Pentesting Erlang Port Mapper Daemon (epmd) network-services-pentesting 048 Network Services44134 Tiller / Helm network-services-pentesting 049 Network Services44818 Pentesting EtherNet/IP network-services-pentesting 050 Network Services47808/udp - BACnet network-services-pentesting 051 Network Services4786 - Cisco Smart Install network-services-pentesting 052 Network Services4840 - Pentesting OPC UA network-services-pentesting 053 Network Services49 - Pentesting TACACS+ network-services-pentesting 054 Network Services500/udp, 4500/udp - Pentesting IPsec/IKE VPN network-services-pentesting 055 Network Services5000 - Pentesting Docker Registry network-services-pentesting 056 Network Services50030-50060-50070-50075-50090 - Pentesting Hadoop network-services-pentesting 057 Network Services502/tcp - Pentesting Modbus Protocol network-services-pentesting 058 Network Services512 - Pentesting Rexec network-services-pentesting 059 Network Services513 - Pentesting Rlogin network-services-pentesting 060 Network Services514 - Pentesting Rsh network-services-pentesting 061 Network Services515 - Pentesting Line Printer Daemon (LPD) network-services-pentesting 062 Network Services53 - Pentesting DNS network-services-pentesting 063 Network Services5353/UDP Multicast DNS (mDNS) and DNS-SD network-services-pentesting 064 Network Services5432 - Pentesting PostgreSQL network-services-pentesting 065 Network Services5439 - Pentesting Redshift network-services-pentesting 066 Network Services548 - Pentesting Apple Filing Protocol (AFP) network-services-pentesting 067 Network Services554,8554 - Pentesting RTSP network-services-pentesting 068 Network Services5555 - Android Debug Bridge network-services-pentesting 069 Network Services5601/tcp - Pentesting Kibana network-services-pentesting 070 Network Services5671,5672 - Pentesting AMQP network-services-pentesting 071 Network Services5800,5801,5900,5901 - Pentesting VNC network-services-pentesting 072 Network Services5984,6984 - Pentesting CouchDB network-services-pentesting 073 Network Services5985, 5986 - Pentesting OMI network-services-pentesting 074 Network Services5985,5986 - Pentesting WinRM network-services-pentesting 075 Network Services6000 - Pentesting X11 network-services-pentesting 076 Network Services623/UDP/TCP - IPMI network-services-pentesting 077 Network Services6379 - Pentesting Redis network-services-pentesting 078 Network Services69 - UDP TFTP network-services-pentesting 079 Network Services7/TCP/UDP - Pentesting Echo Service network-services-pentesting 080 Network Services700 - Pentesting EPP network-services-pentesting 081 Network Services79 - Pentesting Finger network-services-pentesting 082 Network Services80,443 - Pentesting Web Methodology pentesting-web 083 Network Services8009 - Pentesting Apache JServ Protocol (AJP) network-services-pentesting 084 Network Services8086 - Pentesting InfluxDB network-services-pentesting 085 Network Services8089 - Pentesting Splunkd network-services-pentesting 086 Network Services8333, 18333, 38333, 48333, 18444 - Pentesting Bitcoin network-services-pentesting 087 Network Services873 - Pentesting Rsync network-services-pentesting 088 Network Services88tcp/udp - Pentesting Kerberos pentesting-kerberos-88 089 Network Services9000 Pentesting FastCGI network-services-pentesting 090 Network Services9001 - Pentesting HSQLDB network-services-pentesting 091 Network Services9042, 9160 - Pentesting Cassandra network-services-pentesting 092 Network Services9100/tcp - PJL (Printer Job Language) network-services-pentesting 093 Network Services9200 - Pentesting Elasticsearch network-services-pentesting 094 Network ServicesAEM (Adobe Experience Manager) Pentesting pentesting-web 095 Network ServicesAngular pentesting-web 096 Network ServicesApache pentesting-web 097 Network ServicesArtifactory Hacking Guide pentesting-web 098 Network ServicesBasic VoIP Protocols basic-voip-protocols 099 Network ServicesBolt CMS pentesting-web 100 Network ServicesBuckets buckets 101 Network ServicesCGI Pentesting pentesting-web 102 Network ServicesCisco SNMP pentesting-snmp 103 Network ServicesCustom UDP RPC Enumeration & File-Transfer Abuse pentesting-web 104 Network ServicesDisable Functions Bypass - dl Function php-useful-functions-disable_functions-open_basedir-bypass 105 Network Servicesdisablefunctions bypass - PHP 7.0-7.4 (\nix only) php-useful-functions-disable_functions-open_basedir-bypass 106 Network Servicesdisablefunctions bypass - PHP-FPM/FastCGI php-useful-functions-disable_functions-open_basedir-bypass 107 Network Servicesdisablefunctions Bypass via /proc/self/mem php-useful-functions-disable_functions-open_basedir-bypass 108 Network ServicesDjango pentesting-web 109 Network ServicesDotNetNuke (DNN) pentesting-web 110 Network ServicesDrupal drupal 111 Network ServicesDrupal RCE drupal 112 Network ServicesElectron context-isolation RCE via internal code electron-desktop-apps 113 Network ServicesElectron contextIsolation RCE via IPC electron-desktop-apps 114 Network ServicesElectron contextIsolation RCE via preload code electron-desktop-apps 115 Network ServicesElectron Desktop Apps electron-desktop-apps 116 Network ServicesFirebase Database buckets 117 Network ServicesFlask pentesting-web 118 Network ServicesFortinet FortiWeb — Auth bypass via API-prefix traversal and CGIINFO impersonation pentesting-web 119 Network ServicesFTP Bounce attack - Scan pentesting-ftp 120 Network ServicesFTP Bounce Download 2 of FTP File pentesting-ftp 121 Network ServicesGeoNetwork pentesting-web 122 Network ServicesGit pentesting-web 123 Network ServicesGo net/http path handling with CONNECT pentesting-web 124 Network ServicesGrafana pentesting-web 125 Network ServicesGraphQL pentesting-web 126 Network ServicesH2 - Java SQL database pentesting-web 127 Network ServicesHarvesting Tickets from Linux pentesting-kerberos-88 128 Network ServicesHarvesting tickets from Windows pentesting-kerberos-88 129 Network ServicesHistorical ImageTragick disablefunctions Bypass via Imagick php-useful-functions-disable_functions-open_basedir-bypass 130 Network ServicesIIS - Internet Information Services pentesting-web 131 Network ServicesImageMagick Security pentesting-web 132 Network ServicesInternet Printing Protocol network-services-pentesting 133 Network ServicesISPConfig pentesting-web 134 Network ServicesJBoss pentesting-web 135 Network ServicesJira & Confluence pentesting-web 136 Network ServicesJoomla pentesting-web 137 Network ServicesJSP pentesting-web 138 Network Servicesksmbd Attack Surface & SMB2/SMB3 Protocol Fuzzing (syzkaller) pentesting-smb 139 Network ServicesLaravel pentesting-web 140 Network ServicesLegacy PHP safemode bypass via procopen and a custom environment php-useful-functions-disable_functions-open_basedir-bypass 141 Network ServicesMemcache Commands 11211-memcache 142 Network ServicesMeshCentral pentesting-web 143 Network ServicesMicrosoft SharePoint – Pentesting & Exploitation pentesting-web 144 Network Servicesmodcgi php-useful-functions-disable_functions-open_basedir-bypass 145 Network ServicesMoodle pentesting-web 146 Network ServicesNext.js pentesting-web 147 Network ServicesNginx pentesting-web 148 Network ServicesNodeJS Express pentesting-web 149 Network ServicesPentesting ISO 8583 Payment Sockets network-services-pentesting 150 Network ServicesPentesting JDWP - Java Debug Wire Protocol network-services-pentesting 151 Network ServicesPentesting Remote gdbserver network-services-pentesting 152 Network ServicesPentesting SAP network-services-pentesting 153 Network ServicesPentesting Veeam Backup & Replication network-services-pentesting 154 Network ServicesPentesting VoIP pentesting-voip 155 Network ServicesPerl Command-Execution Sinks pentesting-web 156 Network ServicesPHP - RCE abusing object creation: new $GET["a"]($GET["b"]) php-tricks-esp 157 Network ServicesPHP - Useful Functions & disablefunctions/openbasedir bypass php-useful-functions-disable_functions-open_basedir-bypass 158 Network ServicesPHP <= 5.2.9 Safe Mode Bypass on Windows php-useful-functions-disable_functions-open_basedir-bypass 159 Network ServicesPHP 5.2 fopen safemode Bypass php-useful-functions-disable_functions-open_basedir-bypass 160 Network ServicesPHP 5.2.3 - Win32std ext Protections Bypass php-useful-functions-disable_functions-open_basedir-bypass 161 Network ServicesPHP 5.2.4 and 5.2.5 PHP cURL php-useful-functions-disable_functions-open_basedir-bypass 162 Network ServicesPHP 5.2.4 ionCube Extension File-Read Bypass php-useful-functions-disable_functions-open_basedir-bypass 163 Network ServicesPHP 5.x Shellshock Command Execution php-useful-functions-disable_functions-open_basedir-bypass 164 Network ServicesPHP pcntlexec Command Execution php-useful-functions-disable_functions-open_basedir-bypass 165 Network ServicesPHP Perl Extension Safemode Bypass Exploit php-useful-functions-disable_functions-open_basedir-bypass 166 Network ServicesPHP SSRF php-tricks-esp 167 Network ServicesPHP Tricks php-tricks-esp 168 Network ServicesPrestaShop pentesting-web 169 Network ServicesProxmox VE pentesting-web 170 Network ServicesPython pentesting-web 171 Network ServicesRocket.Chat pentesting-web 172 Network ServicesRoundcube pentesting-web 173 Network Servicesrpcclient enumeration pentesting-smb 174 Network ServicesRuby Tricks pentesting-web 175 Network ServicesServiceNow pentesting-web 176 Network ServicesSIP (Session Initiation Protocol) basic-voip-protocols 177 Network ServicesSitecore Experience Platform (XP) – Pre‑auth HTML Cache Poisoning to Post‑auth RCE sitecore 178 Network ServicesSMTP Commands pentesting-smtp 179 Network ServicesSMTP Smuggling pentesting-smtp 180 Network ServicesSNMP RCE pentesting-snmp 181 Network ServicesSource Code Review / SAST Tools pentesting-web 182 Network ServicesSpecial HTTP headers pentesting-web 183 Network ServicesSpring Actuators pentesting-web 184 Network ServicesSymfony pentesting-web 185 Network ServicesTelerik UI for ASP.NET AJAX – Unsafe Reflection via WebResource.axd (type=iec) pentesting-web 186 Network ServicesTomcat tomcat 187 Network ServicesTraefik HTTP/3 Slow-Body Timeout Testing pentesting-web 188 Network ServicesTypes of MSSQL Users pentesting-mssql-microsoft-sql-server 189 Network ServicesUncovering CloudFlare pentesting-web 190 Network ServicesVMware ESX / vCenter Pentesting pentesting-web 191 Network ServicesVue.js pentesting-web 192 Network ServicesWeb API Pentesting pentesting-web 193 Network ServicesWebDAV pentesting-web 194 Network ServicesWerkzeug / Flask Debug pentesting-web 195 Network ServicesWordPress pentesting-web 196 Network ServicesWSGI Post-Exploitation Tricks pentesting-web 197 Network ServicesZabbix Security pentesting-web 198 Network ServicesZoneMinder, motionEye & Motion pentesting-web

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Choose your decrypted JSON once to save access:

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.