Posts on: Protocols

---

DNS translates domain names to IP addresses and is the foundation of every other enumeration path — subdomain discovery feeds HTTP probing, zone transfers expose the entire internal namespace, and misconfigured records enable takeover and cache poisoning. It typically runs on port 53 UDP, with TCP/53 used for large responses, DNSSEC, and zone transfers. 2025–2026 context: zone transfers are thirty years old and still misconfigured in 18% of enterprise DNS setups, and a 2022 survey found 12% of organisations had at least one nameserver allowing unauthorised AXFR. At the same time, DNS rebinding has become a first-class vulnerability class — Microsoft Playwright MCP Server (CVE-2025-9611), Glances (CVE-2026-32632), Rojo (RUSTSEC-2026-0279), and multiple Rust MCP servers were all rebindable in 2026. Cache poisoning returned with BIND 9 CVE-2025-40778 (CVSS 8.6) and the weak-PRNG CVE-2025-40780.

FTP is a clear-text protocol for file transfer that typically runs on TCP port 21 (control channel). There are different commands and status codes in FTP, and not all commands are consistently implemented on the server — which is precisely what makes enumeration valuable: the banner, the supported command set, and the write permissions often determine the entire attack path. 2025–2026 context: FTP is legacy infrastructure that remains in production because appliances, backup systems, and industrial equipment still depend on it. The current CVE feed is dominated by two classes: FTP server implementations with unauthenticated or authenticated RCE (Wing FTP Server, CrushFTP, ProFTPD, the Windows FTP Service), and FTP client-side flaws where a malicious server attacks the connecting client (Wget PASV, GVfs PASV). The client-side class is frequently overlooked — and it turns a seemingly harmless “connect to the target FTP” into a pivot into the attacker’s own network.

The Internet Message Access Protocol (IMAP) works on TCP port 143 (unencrypted) and 993 (implicit TLS). Unlike POP3, IMAP allows online management of email directly on the server and supports folder structures — which makes a compromised IMAP account a live-intelligence source, not just a static mailbox dump. 2025–2026 context: IMAP is no longer just a mail-retrieval protocol — it is the persistence mechanism of choice for advanced adversaries. The 2026 Zimbra espionage campaigns (Laundry Bear, Ulej) used IMAP as a covert, MFA-bypassing persistence channel: after gaining webmail access, they enabled IMAP on the mailbox and created application-specific passwords, allowing continued mailbox access outside the browser session and outside MFA. On the server side, Dovecot, Cyrus, and Courier produced a steady stream of authentication-bypass, memory-disclosure, and command-injection CVEs throughout 2025–2026.

Introduction IPMI is a set of standardized specifications for hardware-based host management systems used for system management and monitoring IPMI provides sysadmins with the ability to manage and monitor systems even if they are powered off or in an unresponsive state using a direct network connection to the system’s hardware without requiring any form of authentication IPMI can also be used for remote upgrades to systems without requiring physical access to the target host. It can also be used for querying inventory information, reviewing hardware logs, and alerting using SNMP Source: HacktheBox Academy IPMI Commands Command Description msf6 auxiliary(scanner/ipmi/ipmi_version) IPMI version detection. msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) Dump IPMI hashes.

Microsoft SQL Server (MSSQL) is Microsoft’s SQL-based relational database management system. The default port is TCP 1433. In Active Directory environments, MSSQL is consistently one of the highest-value targets: it is almost always over-privileged, frequently under-monitored, and the service account running it is typically a domain account with broad rights. 2025–2026 context: the attack surface has expanded in three directions. SQL Server 2025’s AI features (sp_invoke_external_rest_endpoint, CREATE EXTERNAL MODEL) provide native HTTPS exfiltration and C2 channels that never touch xp_cmdshell. Microsoft-signed stored procedures contain SQL injection that re-enables a disabled xp_cmdshell. And Machine Learning Services (sp_execute_external_script) is now a documented xp_cmdshell alternative because EDR has become very good at catching the classic path.

MySQL is an open-source SQL relational database management system. It runs on TCP port 3306 by default, and databases are frequently stored in a single .sql file — which makes a MySQL compromise both a data-disclosure event and, through file write and UDF, a direct path to OS-level code execution. 2025–2026 context: MySQL remains a high-value lateral target because it frequently runs as root or SYSTEM, holds FILE privilege on legacy installations, and exposes the plugin_dir write primitive that UDF exploitation depends on. The current CVE feed is dominated by Group Replication unauthenticated privilege escalation (CVE-2026-101781, CVSS 8.8), UDF privilege escalation (CVE-2025-30721), and application-layer “read-only” bypasses that turn a reporting tool into a file-write primitive (CVE-2025-67509).

Network File System (NFS) is a distributed file system protocol developed by Sun Microsystems in 1984. It lets clients mount remote directories as if they were local. NFS runs on 2049 TCP/UDP; the RPC portmapper (rpcbind) runs on 111 TCP/UDP and is how clients discover NFS and mountd (which is usually on a dynamic port in NFSv3). 2025–2026 context: NFS remains a high-value target because its defaults assume a trusted LAN — AUTH_SYS trusts whatever UID the client sends, NFSv3 sprays RPC services across dynamic ports, and a single careless export option (no_root_squash, or a stray space before (rw)) hands an attacker root on the server. The 2025–2026 CVE feed adds three new layers: rpc.mountd privilege escalation (CVE-2025-12801), NFS-over-TLS client-side flaws (CVE-2025-38571, CVE-2025-68243), and Windows Client for NFS and Portmapper heap overflows (CVE-2026-69949, CVE-2026-71334).

Introduction Communication protocol that facilitates communication between Oracle databases and applications over networks Solution for managing large, complex databases, typically in the healthcare, finance, and retail industries. It has a built-in encryption mechanism that ensures the security of data transmitted. Runs on TCP Port 1521 by default Oracle TNS - Basic Commands Command Description ./odat.py all -s <FQDN/IP> Perform a variety of scans to gather information about the Oracle database services and its components. sqlplus /@<FQDN/IP>/ Log in to the Oracle database. sqlplus username/password@10.129.204.235/XE as sysdba Log in to the Oracle database with sysdba privileges ./odat.py utlfile -s <FQDN/IP> -d -U -P –sysdba –putFile C:\insert\path file.txt ./file.txt Upload a file with Oracle RDBMS. sudo nmap -p1521 -sV 10.129.204.235 –open –script oracle-sid-brute Nmap SID Bruteforcing Oracle RDBMS Interaction Commands Command Description select table_name from all_tables; List all available tables in current database select name, password from sys.user$; Extract password hashes