Infiltr8ForumGitHub

Port scanning

In an Active Directory domain, domain controllers can be easily spotted depending on what services they host. Each service is usually accessible specific TCP and/or UDP port(s) making the DCs stand out in the network. Here is a list of ports to look for when hunting for domain controllers.

  • 53/TCP and 53/UDP for DNS

  • 88/TCP for Kerberos authentication

  • 135/TCP and 135/UDP MS-RPC epmapper (EndPoint Mapper)

  • 137/TCP and 137/UDP for NBT-NS

  • 138/UDP for NetBIOS datagram service

  • 139/TCP for NetBIOS session service

  • 389/TCP for LDAP

  • 636/TCP for LDAPS (LDAP over TLS/SSL)

  • 445/TCP and 445/UDP for SMB

  • 464/TCP and 445/UDP for Kerberos password change

  • 3268/TCP for LDAP Global Catalog

  • 3269/TCP for LDAP Global Catalog over TLS/SSL

The nmap utility can be used to scan for open ports in an IP range.

# -sS for TCP SYN scan
# -n for no name resolution
# --open to only show (possibly) open port(s)
# -p for port(s) number(s) to scan
nmap -sS -n --open -p 88,389 $IP_RANGE

Last updated