// HackTricks · CC BY-NC 4.0
Network Services
198 pages · adapted from upstream with source attribution on every page.
001 Network Services .NET SOAP/WSDL Client Proxy Abuse pentesting-web 002 Network Services 10000/tcp - Network Data Management Protocol (NDMP) network-services-pentesting 003 Network Services 1026 - Pentesting Rusersd network-services-pentesting 004 Network Services 1080 - Pentesting Socks network-services-pentesting 005 Network Services 1099 (legacy 1098/1050) - Pentesting Java RMI and RMI-IIOP network-services-pentesting 006 Network Services 110,995 - Pentesting POP network-services-pentesting 007 Network Services 111/TCP/UDP - Pentesting Portmapper network-services-pentesting 008 Network Services 11211 - Pentesting Memcache 11211-memcache 009 Network Services 113 - Pentesting Ident network-services-pentesting 010 Network Services 123/udp - Pentesting NTP network-services-pentesting 011 Network Services 12346/udp - Pentesting Cisco Catalyst SD-WAN Control Plane network-services-pentesting 012 Network Services 135, 593 - Pentesting MSRPC network-services-pentesting 013 Network Services 137,138,139 - Pentesting NetBios network-services-pentesting 014 Network Services 139,445 - Pentesting SMB pentesting-smb 015 Network Services 1414 - Pentesting IBM MQ network-services-pentesting 016 Network Services 143,993 - Pentesting IMAP network-services-pentesting 017 Network Services 1433 - Pentesting MSSQL - Microsoft SQL Server pentesting-mssql-microsoft-sql-server 018 Network Services 1521, 1522-1529 - Pentesting Oracle TNS Listener network-services-pentesting 019 Network Services 15672 - Pentesting RabbitMQ Management network-services-pentesting 020 Network Services 161/udp, 162/udp, 10161-10162/tcp/udp - Pentesting SNMP pentesting-snmp 021 Network Services 1723 - Pentesting PPTP network-services-pentesting 022 Network Services 1883 - Pentesting MQTT (Mosquitto) network-services-pentesting 023 Network Services 194,6667,6660-7000 - Pentesting IRC network-services-pentesting 024 Network Services 2049 - Pentesting NFS Service network-services-pentesting 025 Network Services 21 - Pentesting FTP pentesting-ftp 026 Network Services 22 - Pentesting SSH/SFTP network-services-pentesting 027 Network Services 23 - Pentesting Telnet network-services-pentesting 028 Network Services 2301, 2381 - Pentesting Compaq/HP Insight Manager network-services-pentesting 029 Network Services 2375, 2376 Pentesting Docker network-services-pentesting 030 Network Services 24007-24008-24009-49152 - Pentesting GlusterFS network-services-pentesting 031 Network Services 25, 465, 587 - Pentesting SMTP pentesting-smtp 032 Network Services 264/tcp - Pentesting Check Point Firewall network-services-pentesting 033 Network Services 27017,27018 - Pentesting MongoDB network-services-pentesting 034 Network Services 3128/tcp - Pentesting Squid network-services-pentesting 035 Network Services 32100/UDP - Pentesting PPPP (CS2) P2P Cameras network-services-pentesting 036 Network Services 3260 - Pentesting iSCSI network-services-pentesting 037 Network Services 3299/tcp - Pentesting SAProuter network-services-pentesting 038 Network Services 3306 - Pentesting MySQL network-services-pentesting 039 Network Services 3389 - Pentesting RDP network-services-pentesting 040 Network Services 3632 - Pentesting Distcc network-services-pentesting 041 Network Services 3690/tcp - Pentesting Subversion (SVN) Server network-services-pentesting 042 Network Services 3702/UDP - Pentesting WS-Discovery network-services-pentesting 043 Network Services 389, 636, 3268, 3269 - Pentesting LDAP network-services-pentesting 044 Network Services 403 & 401 Bypasses pentesting-web 045 Network Services 4222 - Pentesting NATS / JetStream network-services-pentesting 046 Network Services 43 - Pentesting WHOIS network-services-pentesting 047 Network Services 4369 Pentesting Erlang Port Mapper Daemon (epmd) network-services-pentesting 048 Network Services 44134 Tiller / Helm network-services-pentesting 049 Network Services 44818 Pentesting EtherNet/IP network-services-pentesting 050 Network Services 47808/udp - BACnet network-services-pentesting 051 Network Services 4786 - Cisco Smart Install network-services-pentesting 052 Network Services 4840 - Pentesting OPC UA network-services-pentesting 053 Network Services 49 - Pentesting TACACS+ network-services-pentesting 054 Network Services 500/udp, 4500/udp - Pentesting IPsec/IKE VPN network-services-pentesting 055 Network Services 5000 - Pentesting Docker Registry network-services-pentesting 056 Network Services 50030-50060-50070-50075-50090 - Pentesting Hadoop network-services-pentesting 057 Network Services 502/tcp - Pentesting Modbus Protocol network-services-pentesting 058 Network Services 512 - Pentesting Rexec network-services-pentesting 059 Network Services 513 - Pentesting Rlogin network-services-pentesting 060 Network Services 514 - Pentesting Rsh network-services-pentesting 061 Network Services 515 - Pentesting Line Printer Daemon (LPD) network-services-pentesting 062 Network Services 53 - Pentesting DNS network-services-pentesting 063 Network Services 5353/UDP Multicast DNS (mDNS) and DNS-SD network-services-pentesting 064 Network Services 5432 - Pentesting PostgreSQL network-services-pentesting 065 Network Services 5439 - Pentesting Redshift network-services-pentesting 066 Network Services 548 - Pentesting Apple Filing Protocol (AFP) network-services-pentesting 067 Network Services 554,8554 - Pentesting RTSP network-services-pentesting 068 Network Services 5555 - Android Debug Bridge network-services-pentesting 069 Network Services 5601/tcp - Pentesting Kibana network-services-pentesting 070 Network Services 5671,5672 - Pentesting AMQP network-services-pentesting 071 Network Services 5800,5801,5900,5901 - Pentesting VNC network-services-pentesting 072 Network Services 5984,6984 - Pentesting CouchDB network-services-pentesting 073 Network Services 5985, 5986 - Pentesting OMI network-services-pentesting 074 Network Services 5985,5986 - Pentesting WinRM network-services-pentesting 075 Network Services 6000 - Pentesting X11 network-services-pentesting 076 Network Services 623/UDP/TCP - IPMI network-services-pentesting 077 Network Services 6379 - Pentesting Redis network-services-pentesting 078 Network Services 69 - UDP TFTP network-services-pentesting 079 Network Services 7/TCP/UDP - Pentesting Echo Service network-services-pentesting 080 Network Services 700 - Pentesting EPP network-services-pentesting 081 Network Services 79 - Pentesting Finger network-services-pentesting 082 Network Services 80,443 - Pentesting Web Methodology pentesting-web 083 Network Services 8009 - Pentesting Apache JServ Protocol (AJP) network-services-pentesting 084 Network Services 8086 - Pentesting InfluxDB network-services-pentesting 085 Network Services 8089 - Pentesting Splunkd network-services-pentesting 086 Network Services 8333, 18333, 38333, 48333, 18444 - Pentesting Bitcoin network-services-pentesting 087 Network Services 873 - Pentesting Rsync network-services-pentesting 088 Network Services 88tcp/udp - Pentesting Kerberos pentesting-kerberos-88 089 Network Services 9000 Pentesting FastCGI network-services-pentesting 090 Network Services 9001 - Pentesting HSQLDB network-services-pentesting 091 Network Services 9042, 9160 - Pentesting Cassandra network-services-pentesting 092 Network Services 9100/tcp - PJL (Printer Job Language) network-services-pentesting 093 Network Services 9200 - Pentesting Elasticsearch network-services-pentesting 094 Network Services AEM (Adobe Experience Manager) Pentesting pentesting-web 095 Network Services Angular pentesting-web 096 Network Services Apache pentesting-web 097 Network Services Artifactory Hacking Guide pentesting-web 098 Network Services Basic VoIP Protocols basic-voip-protocols 099 Network Services Bolt CMS pentesting-web 100 Network Services Buckets buckets 101 Network Services CGI Pentesting pentesting-web 102 Network Services Cisco SNMP pentesting-snmp 103 Network Services Custom UDP RPC Enumeration & File-Transfer Abuse pentesting-web 104 Network Services Disable Functions Bypass - dl Function php-useful-functions-disable_functions-open_basedir-bypass 105 Network Services disablefunctions bypass - PHP 7.0-7.4 (\nix only) php-useful-functions-disable_functions-open_basedir-bypass 106 Network Services disablefunctions bypass - PHP-FPM/FastCGI php-useful-functions-disable_functions-open_basedir-bypass 107 Network Services disablefunctions Bypass via /proc/self/mem php-useful-functions-disable_functions-open_basedir-bypass 108 Network Services Django pentesting-web 109 Network Services DotNetNuke (DNN) pentesting-web 110 Network Services Drupal drupal 111 Network Services Drupal RCE drupal 112 Network Services Electron context-isolation RCE via internal code electron-desktop-apps 113 Network Services Electron contextIsolation RCE via IPC electron-desktop-apps 114 Network Services Electron contextIsolation RCE via preload code electron-desktop-apps 115 Network Services Electron Desktop Apps electron-desktop-apps 116 Network Services Firebase Database buckets 117 Network Services Flask pentesting-web 118 Network Services Fortinet FortiWeb — Auth bypass via API-prefix traversal and CGIINFO impersonation pentesting-web 119 Network Services FTP Bounce attack - Scan pentesting-ftp 120 Network Services FTP Bounce Download 2 of FTP File pentesting-ftp 121 Network Services GeoNetwork pentesting-web 122 Network Services Git pentesting-web 123 Network Services Go net/http path handling with CONNECT pentesting-web 124 Network Services Grafana pentesting-web 125 Network Services GraphQL pentesting-web 126 Network Services H2 - Java SQL database pentesting-web 127 Network Services Harvesting Tickets from Linux pentesting-kerberos-88 128 Network Services Harvesting tickets from Windows pentesting-kerberos-88 129 Network Services Historical ImageTragick disablefunctions Bypass via Imagick php-useful-functions-disable_functions-open_basedir-bypass 130 Network Services IIS - Internet Information Services pentesting-web 131 Network Services ImageMagick Security pentesting-web 132 Network Services Internet Printing Protocol network-services-pentesting 133 Network Services ISPConfig pentesting-web 134 Network Services JBoss pentesting-web 135 Network Services Jira & Confluence pentesting-web 136 Network Services Joomla pentesting-web 137 Network Services JSP pentesting-web 138 Network Services ksmbd Attack Surface & SMB2/SMB3 Protocol Fuzzing (syzkaller) pentesting-smb 139 Network Services Laravel pentesting-web 140 Network Services Legacy PHP safemode bypass via procopen and a custom environment php-useful-functions-disable_functions-open_basedir-bypass 141 Network Services Memcache Commands 11211-memcache 142 Network Services MeshCentral pentesting-web 143 Network Services Microsoft SharePoint – Pentesting & Exploitation pentesting-web 144 Network Services modcgi php-useful-functions-disable_functions-open_basedir-bypass 145 Network Services Moodle pentesting-web 146 Network Services Next.js pentesting-web 147 Network Services Nginx pentesting-web 148 Network Services NodeJS Express pentesting-web 149 Network Services Pentesting ISO 8583 Payment Sockets network-services-pentesting 150 Network Services Pentesting JDWP - Java Debug Wire Protocol network-services-pentesting 151 Network Services Pentesting Remote gdbserver network-services-pentesting 152 Network Services Pentesting SAP network-services-pentesting 153 Network Services Pentesting Veeam Backup & Replication network-services-pentesting 154 Network Services Pentesting VoIP pentesting-voip 155 Network Services Perl Command-Execution Sinks pentesting-web 156 Network Services PHP - RCE abusing object creation: new $GET["a"]($GET["b"]) php-tricks-esp 157 Network Services PHP - Useful Functions & disablefunctions/openbasedir bypass php-useful-functions-disable_functions-open_basedir-bypass 158 Network Services PHP <= 5.2.9 Safe Mode Bypass on Windows php-useful-functions-disable_functions-open_basedir-bypass 159 Network Services PHP 5.2 fopen safemode Bypass php-useful-functions-disable_functions-open_basedir-bypass 160 Network Services PHP 5.2.3 - Win32std ext Protections Bypass php-useful-functions-disable_functions-open_basedir-bypass 161 Network Services PHP 5.2.4 and 5.2.5 PHP cURL php-useful-functions-disable_functions-open_basedir-bypass 162 Network Services PHP 5.2.4 ionCube Extension File-Read Bypass php-useful-functions-disable_functions-open_basedir-bypass 163 Network Services PHP 5.x Shellshock Command Execution php-useful-functions-disable_functions-open_basedir-bypass 164 Network Services PHP pcntlexec Command Execution php-useful-functions-disable_functions-open_basedir-bypass 165 Network Services PHP Perl Extension Safemode Bypass Exploit php-useful-functions-disable_functions-open_basedir-bypass 166 Network Services PHP SSRF php-tricks-esp 167 Network Services PHP Tricks php-tricks-esp 168 Network Services PrestaShop pentesting-web 169 Network Services Proxmox VE pentesting-web 170 Network Services Python pentesting-web 171 Network Services Rocket.Chat pentesting-web 172 Network Services Roundcube pentesting-web 173 Network Services rpcclient enumeration pentesting-smb 174 Network Services Ruby Tricks pentesting-web 175 Network Services ServiceNow pentesting-web 176 Network Services SIP (Session Initiation Protocol) basic-voip-protocols 177 Network Services Sitecore Experience Platform (XP) – Pre‑auth HTML Cache Poisoning to Post‑auth RCE sitecore 178 Network Services SMTP Commands pentesting-smtp 179 Network Services SMTP Smuggling pentesting-smtp 180 Network Services SNMP RCE pentesting-snmp 181 Network Services Source Code Review / SAST Tools pentesting-web 182 Network Services Special HTTP headers pentesting-web 183 Network Services Spring Actuators pentesting-web 184 Network Services Symfony pentesting-web 185 Network Services Telerik UI for ASP.NET AJAX – Unsafe Reflection via WebResource.axd (type=iec) pentesting-web 186 Network Services Tomcat tomcat 187 Network Services Traefik HTTP/3 Slow-Body Timeout Testing pentesting-web 188 Network Services Types of MSSQL Users pentesting-mssql-microsoft-sql-server 189 Network Services Uncovering CloudFlare pentesting-web 190 Network Services VMware ESX / vCenter Pentesting pentesting-web 191 Network Services Vue.js pentesting-web 192 Network Services Web API Pentesting pentesting-web 193 Network Services WebDAV pentesting-web 194 Network Services Werkzeug / Flask Debug pentesting-web 195 Network Services WordPress pentesting-web 196 Network Services WSGI Post-Exploitation Tricks pentesting-web 197 Network Services Zabbix Security pentesting-web 198 Network Services ZoneMinder, motionEye & Motion pentesting-web