The last lecture we talked about through a handshake.
Now we just want to get it to support, right?
So let's say you've got some observers here and you have two applications ready to applications, just
let's call it, let's say, the Windows Windows Server 2019.
And you've got eyes listening on Port City.
And you also have, as I say, listening on port to.
Right.
So far, so good to me.
So, you know, this is this is not uncommon, actually.
All right.
So you're running I ask you this in the port 80 and you also have associates that you can monitor your
server.
Now, you've got this client up here, user wants to access a Web page on the server.
How exactly is that going to happen?
Right.
How are we going to get access over here?
Well, it's a couple of things, right?
First, the client need to tell the server which application it wants to access.
How does the client tell the server what it wants?
Do I want SSA to do?
And what is what does that what?
The ports.
So you can have multiple ports, listening, multiple applications, listening for incoming requests
on a single server.
And the port just tells the incoming application request which applications are processed that request
the way the client does that is by specifying a destination.
Port in this case would be 80 because it wants to access the Web application.
Now, the interesting thing here is that.
When the server wants to respond to the client, how how's it going to do that?
Because there's no port on the site, or is there if there is and this is what ephemeral ports are.
So this application over here would randomize a port that's greater than 10, 20 for it's called an
ephemeral port in Murro Port.
It's greater than 10 24.
Let's say that port is six five, one, two.
OK, that's different port.
So that's going to become the source.
You can't really see that.
That's basically going to become the source port.
Change that to white sauce, part of the sauce part.
Now, when the Web server wants to return the page that was requested, it can now reverse the communication
stream.
Right.
So now when the response comes back.
The.
Support is going to be.
Eighty and the dust is going to be six, five, one, two, and now the application can process the
request.
That's basically how that works.
Now, if there are a couple of common points that everyone should know, let's look at these really
fast, because, you know, you're going to see this come up a lot.
So here are some thoughts that everyone needs to know in this field where.
Is one of them each and each step as its GDP is point eighty 80.
IDP's is four, four, three and sometimes eight four four three.
This is Web traffic standard web traffic.
Right.
That right.
Nothing too surprising there.
Let's keep going down the list of other things you need to know, OK?
There is also Tonette.
And SNH, the both of these protocols that you or you know, someone else, a network administrator
or network engineer, manager device, Tonette is 23, but the traffic is unencrypted.
Credentials are exposed in clear text message, six point twenty two, but it is encrypted.
OK, so let's just drive that point home by saying this is encrypted, an encrypted and this is encrypted.
That is the major difference between these two.
What other ports do we need to know was a few others there is we mentioned this once DNS.
And you have d.H, copy that, so Dinesh uses UDP point fifty three to translate domain names into IP
addresses and DCP uses UDP ports sixty seven and sixty eight.
And what DCB does the dynamic host configuration protocol?
It is the protocol that's responsible for dynamically assigning IP addresses to a computer so you don't
have to physically type in an IP address.
DCP does that for you based on a pool of administratively assigned addresses and it uses different ports
depending on the client sending to the server or the server sending to the client.
It will determine which port to use for the source port kirsanow.
What else do we have here?
What else should you know about?
Well, let's see.
You should also know about FTB.
FTP is the TCP Port 21 for moving files.
All right.
We also can talk about.
SMTP and IMAP, so S&P uses two point twenty five, this is for sending emails between different email
servers or sending those emails out, they go out on Tsipi for 25.
IMAP uses one for three with the unencrypted version.
And that's for getting emails like in Gmail or something similar.
But DeMott actually doesn't use IMAP overreport one for three.
It uses the encrypted version of it.
OK, we can talk about RTP.
If you're doing a fantastic RTP, you see a server listing and RTP.
That might mean that you can remotely, you know, connect to the device and see what an administrator
would say.
That's already PITAs remote desktop protocol.
This uses three three eight nine TCP.
And then of course you have SMB server message block.
This uses port four for five, member for four, three is Tlas, SSL or IDP's for four or five is the
TCP server message block.
And this is for FoW shares and printers and things like that in the last port.
I think it's really important that ports so there is held up.
Which lessons are important, three eight nine Tsipi When you have eldership s, which is the encrypted
version of that but it listens important six thirty six.
So really what you need to know here is that one is encrypted or what is it.
So this is unencrypted on encrypted and elderberries is encrypted.
And again, this is used for Acad Rectory, the lightweight directory access protocol.
So we're going to get into active directory a lot later.
And of course, we set up our lab and we do our red team engagements and we run all our tests.
But it's really important that, you know the difference between so you can understand the attack surface
of your target.
All right.
So that's all we want to get into in this lecture.
We just talked about some of the ports, but you need to know, oh, there's one more I think I should
mention before we wrap this up.
And that would be A.P..
So in the network time protocol and this protocol in tpy he says UDP one to three, very easy to remember.
Right UDP.
And that's obviously for that allows the computer to get the time from a remote server so it can synchronize
its local time to limit service time and have accurate time clock.
So that's it in the next hour, should we be taking to the other protocols and stuff specifically?
Never see in that as.