Posts on: Protocols

---

Post Office Protocol version 3 (POP3) is a mail retrieval protocol: a client connects to the mail server, authenticates, and downloads messages to the local machine. Unlike IMAP, POP3 is a single-mailbox, download-and-store protocol — it does not synchronise folders, flags, or server-side state. Default ports: Port Service Encryption 110 POP3 Plaintext — STARTTLS optional 995 POP3S Implicit TLS 110 POP3 + STLS STARTTLS upgrade 2025–2026 context: POP3 is legacy, and that is the entire security story. It is still deployed on mail appliances, cPanel/Plesk hosting, and industrial equipment because it is simple — and it is frequently exposed to the internet without rate limiting, with plaintext credentials on port 110, and with no MFA. The current attack surface is not the protocol itself but the mail server implementation (Dovecot, Courier, Cyrus, Exim, Postfix), where 2025–2026 produced a steady stream of CVEs in mail parsers, TLS handling, and authentication.

Remote Desktop Protocol (RDP) provides a graphical interface to connect to another computer over a network connection. It is one of the most popular administration tools — and one of the most consistently exploited gateways, because it is enabled by default, frequently exposed, and under-monitored. Default port: TCP/3389. 2025–2026 context: RDP is not a legacy target. Microsoft shipped multiple critical RDP Server and Client CVEs across 2026 — authenticated and unauthenticated use-after-free flaws (CVE-2026-58626, CVE-2026-69525), an actively exploited privilege escalation (CVE-2026-21533), a CVSS 9.8 client-side RCE (CVE-2026-54990), and two xrdp vulnerabilities (CVE-2026-32105, CVE-2026-32107). At the same time, BlueKeep (CVE-2019-0708) was revived by the North Korean Kimsuky APT in a 2025 campaign against South Korea and Japan, proving that a 2019 pre-auth RCE remains a live initial-access vector on unpatched systems.

Server Message Block (SMB) is a client-server protocol that regulates access to files, directories, and other network resources. An SMB server exposes arbitrary parts of its local filesystem as shares, with access governed by ACLs. SMB runs on TCP port 445 by default (NetBIOS over TCP/139 is legacy). 2025–2026 context: SMB remains the single most valuable protocol in an AD environment — it is the file-access layer, the relay target, and the coercion transport. Three developments define the current landscape. CVE-2025-33073 resurrected NTLM reflection and removed the admin prerequisite for relay-based SYSTEM access. SMBGhost (CVE-2020-0796) is still in CISA’s KEV catalog, with estates still negotiating SMB 3.1.1 compression — one crafted packet away from Ring 0. And 2026 produced a cluster of SMB Server privilege-escalation CVEs (race conditions, auth-algorithm flaws, unbounded resource allocation) that are network-reachable with any authenticated account.

The Simple Mail Transfer Protocol (SMTP) sends email; IMAP or POP3 retrieve it. SMTP is the front door for phishing, spoofing, and BEC — and it is the protocol most often left at defaults on appliances, printers, and legacy applications. Default ports: Port Service Encryption 25 SMTP (MTA-to-MTA) Opportunistic STARTTLS 587 Submission (client-to-MTA) STARTTLS required 465 SMTPS Implicit TLS 2525 Alternate submission Varies UDP/25 is not a usable mail transport. Do not scan SMTP over UDP.

Simple Network Management Protocol (SNMP) is used to monitor and manage devices on a network — routers, switches, firewalls, printers, UPSes, and NAS appliances. It exposes device information through Object Identifiers (OIDs) organised in a Management Information Base (MIB) tree, and it frequently contains logs, configuration, and credentials. Ports: UDP/161 for agent queries, UDP/162 for traps. The most common reconnaissance failure is scanning only TCP. SNMP is UDP-only. A TCP-only scan reports the host as having no SNMP service, and the entire attack surface is missed.