book.hacktricks.xyz Open in urlscan Pro
2606:4700:4400::6812:282f  Public Scan

Form analysis
0 forms found in the DOM

Text Content

HackTricks
HackTricks
TwitterLinkedinSponsorTwitchYoutube

Ask or search…
⌃K

Links
👾
Welcome!
HackTricks
HackTricks Values & FAQ
About the author
🤩
Generic Methodologies & Resources
Pentesting Methodology
External Recon Methodology

Pentesting Network

Pentesting Wifi

Phishing Methodology

Basic Forensic Methodology

Brute Force - CheatSheet
Python Sandbox Escape & Pyscript

Exfiltration
Tunneling and Port Forwarding
Threat Modeling
Search Exploits
Shells (Linux, Windows, MSFVenom)

🐧
Linux Hardening
Checklist - Linux Privilege Escalation
Linux Privilege Escalation

Useful Linux Commands
Bypass Linux Restrictions

Linux Environment Variables
Linux Post-Exploitation

FreeIPA Pentesting
🍏
MacOS Hardening
macOS Security & Privilege Escalation

macOS Red Teaming

macOS Useful Commands
macOS Auto Start
🪟
Windows Hardening
Checklist - Local Windows Privilege Escalation
Windows Local Privilege Escalation

Active Directory Methodology

Windows Security Controls

NTLM

Lateral Movement

Pivoting to the Cloud

Stealing Windows Credentials

Basic Win CMD for Pentesters
Basic PowerShell for Pentesters

Antivirus (AV) Bypass
📱
Mobile Pentesting
Android APK Checklist
Android Applications Pentesting

iOS Pentesting Checklist
iOS Pentesting

Cordova Apps
Xamarin Apps
👽
Network Services Pentesting
Pentesting JDWP - Java Debug Wire Protocol
Pentesting Printers

Pentesting SAP
Pentesting VoIP

Pentesting Remote GdbServer
7/tcp/udp - Pentesting Echo
21 - Pentesting FTP

22 - Pentesting SSH/SFTP
23 - Pentesting Telnet
25,465,587 - Pentesting SMTP/s

43 - Pentesting WHOIS
49 - Pentesting TACACS+
53 - Pentesting DNS
69/UDP TFTP/Bittorrent-tracker
79 - Pentesting Finger
80,443 - Pentesting Web Methodology

88tcp/udp - Pentesting Kerberos

110,995 - Pentesting POP
111/TCP/UDP - Pentesting Portmapper
113 - Pentesting Ident
123/udp - Pentesting NTP
135, 593 - Pentesting MSRPC
137,138,139 - Pentesting NetBios
139,445 - Pentesting SMB

143,993 - Pentesting IMAP
161,162,10161,10162/udp - Pentesting SNMP

194,6667,6660-7000 - Pentesting IRC
264 - Pentesting Check Point FireWall-1
389, 636, 3268, 3269 - Pentesting LDAP
500/udp - Pentesting IPsec/IKE VPN
502 - Pentesting Modbus
512 - Pentesting Rexec
513 - Pentesting Rlogin
514 - Pentesting Rsh
515 - Pentesting Line Printer Daemon (LPD)
548 - Pentesting Apple Filing Protocol (AFP)
554,8554 - Pentesting RTSP
623/UDP/TCP - IPMI
631 - Internet Printing Protocol(IPP)
873 - Pentesting Rsync
1026 - Pentesting Rusersd
1080 - Pentesting Socks
1098/1099/1050 - Pentesting Java RMI - RMI-IIOP
1414 - Pentesting IBM MQ
1433 - Pentesting MSSQL - Microsoft SQL Server

1521,1522-1529 - Pentesting Oracle TNS Listener
1723 - Pentesting PPTP
1883 - Pentesting MQTT (Mosquitto)
2049 - Pentesting NFS Service
2301,2381 - Pentesting Compaq/HP Insight Manager
2375, 2376 Pentesting Docker
3128 - Pentesting Squid
3260 - Pentesting ISCSI
3299 - Pentesting SAPRouter
3306 - Pentesting Mysql
3389 - Pentesting RDP
3632 - Pentesting distcc
3690 - Pentesting Subversion (svn server)
3702/UDP - Pentesting WS-Discovery
4369 - Pentesting Erlang Port Mapper Daemon (epmd)
4786 - Cisco Smart Install
4840 - OPC Unified Architecture
5000 - Pentesting Docker Registry
5353/UDP Multicast DNS (mDNS) and DNS-SD
5432,5433 - Pentesting Postgresql
5439 - Pentesting Redshift
5555 - Android Debug Bridge
5601 - Pentesting Kibana
5671,5672 - Pentesting AMQP
5800,5801,5900,5901 - Pentesting VNC
5984,6984 - Pentesting CouchDB
5985,5986 - Pentesting WinRM
5985,5986 - Pentesting OMI
6000 - Pentesting X11
6379 - Pentesting Redis
8009 - Pentesting Apache JServ Protocol (AJP)
8086 - Pentesting InfluxDB
8089 - Pentesting Splunkd
8333,18333,38333,18444 - Pentesting Bitcoin
9000 - Pentesting FastCGI
9001 - Pentesting HSQLDB
9042/9160 - Pentesting Cassandra
9100 - Pentesting Raw Printing (JetDirect, AppSocket, PDL-datastream)
9200 - Pentesting Elasticsearch
10000 - Pentesting Network Data Management Protocol (ndmp)
11211 - Pentesting Memcache

15672 - Pentesting RabbitMQ Management
24007,24008,24009,49152 - Pentesting GlusterFS
27017,27018 - Pentesting MongoDB
44134 - Pentesting Tiller (Helm)
44818/UDP/TCP - Pentesting EthernetIP
47808/udp - Pentesting BACNet
50030,50060,50070,50075,50090 - Pentesting Hadoop
🕸
Pentesting Web
Web Vulnerabilities Methodology
Reflecting Techniques - PoCs and Polygloths CheatSheet

2FA/OTP Bypass
Account Takeover
Browser Extension Pentesting Methodology

Bypass Payment Process
Captcha Bypass
Cache Poisoning and Cache Deception
Clickjacking
Client Side Template Injection (CSTI)
Client Side Path Traversal
Command Injection
Content Security Policy (CSP) Bypass

Cookies Hacking

CORS - Misconfigurations & Bypass
CRLF (%0D%0A) Injection
CSRF (Cross Site Request Forgery)
Dangling Markup - HTML scriptless injection

Dependency Confusion
Deserialization

Domain/Subdomain takeover
Email Injections
File Inclusion/Path traversal

File Upload

Formula/CSV/Doc/LaTeX/GhostScript Injection
gRPC-Web Pentest
HTTP Connection Contamination
HTTP Connection Request Smuggling
HTTP Request Smuggling / HTTP Desync Attack

HTTP Response Smuggling / Desync
Upgrade Header Smuggling
hop-by-hop headers
IDOR
Integer Overflow
JWT Vulnerabilities (Json Web Tokens)
LDAP Injection
Login Bypass

NoSQL injection
OAuth to Account takeover
Open Redirect
Parameter Pollution
Phone Number Injections
PostMessage Vulnerabilities

Proxy / WAF Protections Bypass
Race Condition
Rate Limit Bypass
Registration & Takeover Vulnerabilities
Regular expression Denial of Service - ReDoS
Reset/Forgotten Password Bypass
SAML Attacks

Server Side Inclusion/Edge Side Inclusion Injection
SQL Injection

SSRF (Server Side Request Forgery)

SSTI (Server Side Template Injection)

Reverse Tab Nabbing
Unicode Injection

WebSocket Attacks
Web Tool - WFuzz
XPATH injection
XSLT Server Side Injection (Extensible Stylesheet Language Transformations)
XXE - XEE - XML External Entity
XSS (Cross Site Scripting)

XSSI (Cross-Site Script Inclusion)
XS-Search/XS-Leaks

⛈
Cloud Security
Pentesting Kubernetes

Pentesting Cloud (AWS, GCP, Az...)

Pentesting CI/CD (Github, Jenkins, Terraform...)

😎
Hardware/Physical Access
Physical Attacks
Escaping from KIOSKs
Firmware Analysis

🦅
Reversing & Exploiting
Reversing Tools & Basic Methods

Common API used in Malware
Word Macros
Linux Exploiting (Basic) (SPA)

Exploiting Tools

Windows Exploiting (Basic Guide - OSCP lvl)
🔮
Crypto & Stego
Cryptographic/Compression Algorithms

Certificates
Cipher Block Chaining CBC-MAC
Crypto CTFs Tricks
Electronic Code Book (ECB)
Hash Length Extension Attack
Padding Oracle
RC4 - Encrypt&Decrypt
Stego Tricks
Esoteric languages
Blockchain & Crypto Currencies
🦂
C2
Salseo
ICMPsh
Cobalt Strike
✍
TODO
Other Big References
Rust Basics
More Tools
MISC
Pentesting DNS
Hardware Hacking

Radio Hacking

Burp Suite
Other Web Tricks
Interesting HTTP
Emails Vulnerabilities
Android Forensics
TR-069
6881/udp - Pentesting BitTorrent
Online Platforms with API
Stealing Sensitive Information Disclosure from a Web
Post Exploitation
Cookies Policy
Powered By GitBook


69/UDP TFTP/BITTORRENT-TRACKER



Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team
Expert)!

Other ways to support HackTricks:
If you want to see your company advertised in HackTricks or download HackTricks
in PDF Check the SUBSCRIPTION PLANS!
Get the official PEASS & HackTricks swag
Discover The PEASS Family, our collection of exclusive NFTs
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦
@carlospolopm.
Share your hacking tricks by submitting PRs to the HackTricks and HackTricks
Cloud github repos.

BASIC INFORMATION

Trivial File Transfer Protocol (TFTP) is a straightforward protocol used on UDP
port 69 that allows file transfers without needing authentication. Highlighted
in RFC 1350, its simplicity means it lacks key security features, leading to
limited use on the public Internet. However, TFTP is extensively utilized within
large internal networks for distributing configuration files and ROM images to
devices such as VoIP handsets, thanks to its efficiency in these specific
scenarios.
TODO: Provide information about what is a Bittorrent-tracker (Shodan identifies
this port with that name). If you have more info about this let us know for
example in the HackTricks telegram group (or in a github issue in PEASS).
Default Port: 69/UDP
PORT STATE SERVICE REASON
69/udp open tftp script-set

ENUMERATION

TFTP doesn't provide directory listing so the script tftp-enum from nmap will
try to brute-force default paths.
nmap -n -Pn -sU -p69 -sV --script tftp-enum <IP>

DOWNLOAD/UPLOAD

You can use Metasploit or Python to check if you can download/upload files:
msf5> auxiliary/admin/tftp/tftp_transfer_util

import tftpy
client = tftpy.TftpClient(<ip>, <port>)
client.download("filename in server", "/tmp/filename", timeout=5)
client.upload("filename to upload", "/local/path/file", timeout=5)

SHODAN

port:69

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team
Expert)!

Other ways to support HackTricks:
If you want to see your company advertised in HackTricks or download HackTricks
in PDF Check the SUBSCRIPTION PLANS!
Get the official PEASS & HackTricks swag
Discover The PEASS Family, our collection of exclusive NFTs
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦
@carlospolopm.
Share your hacking tricks by submitting PRs to the HackTricks and HackTricks
Cloud github repos.

Network Services Pentesting - Previous
53 - Pentesting DNS
Next - Network Services Pentesting
79 - Pentesting Finger

Last modified 3d ago
Was this page helpful?

On this page
Basic Information
Enumeration
Download/Upload
Shodan
To pick up a draggable item, press the space bar. While dragging, use the arrow
keys to move the item. Press space again to drop the item in its new position,
or press escape to cancel.

CookiesThis site uses cookies to deliver its service and to analyse traffic. By
browsing this site, you accept the cookie policy.
Reject all


Close
HackTricks
Change appearance

👾
Welcome!
HackTricks
HackTricks Values & FAQ
About the author
🤩
Generic Methodologies & Resources
Pentesting Methodology
External Recon Methodology

Pentesting Network

Pentesting Wifi

Phishing Methodology

Basic Forensic Methodology

Brute Force - CheatSheet
Python Sandbox Escape & Pyscript

Exfiltration
Tunneling and Port Forwarding
Threat Modeling
Search Exploits
Shells (Linux, Windows, MSFVenom)

🐧
Linux Hardening
Checklist - Linux Privilege Escalation
Linux Privilege Escalation

Useful Linux Commands
Bypass Linux Restrictions

Linux Environment Variables
Linux Post-Exploitation

FreeIPA Pentesting
🍏
MacOS Hardening
macOS Security & Privilege Escalation

macOS Red Teaming

macOS Useful Commands
macOS Auto Start
🪟
Windows Hardening
Checklist - Local Windows Privilege Escalation
Windows Local Privilege Escalation

Active Directory Methodology

Windows Security Controls

NTLM

Lateral Movement

Pivoting to the Cloud

Stealing Windows Credentials

Basic Win CMD for Pentesters
Basic PowerShell for Pentesters

Antivirus (AV) Bypass
📱
Mobile Pentesting
Android APK Checklist
Android Applications Pentesting

iOS Pentesting Checklist
iOS Pentesting

Cordova Apps
Xamarin Apps
👽
Network Services Pentesting
Pentesting JDWP - Java Debug Wire Protocol
Pentesting Printers

Pentesting SAP
Pentesting VoIP

Pentesting Remote GdbServer
7/tcp/udp - Pentesting Echo
21 - Pentesting FTP

22 - Pentesting SSH/SFTP
23 - Pentesting Telnet
25,465,587 - Pentesting SMTP/s

43 - Pentesting WHOIS
49 - Pentesting TACACS+
53 - Pentesting DNS
69/UDP TFTP/Bittorrent-tracker
79 - Pentesting Finger
80,443 - Pentesting Web Methodology

88tcp/udp - Pentesting Kerberos

110,995 - Pentesting POP
111/TCP/UDP - Pentesting Portmapper
113 - Pentesting Ident
123/udp - Pentesting NTP
135, 593 - Pentesting MSRPC
137,138,139 - Pentesting NetBios
139,445 - Pentesting SMB

143,993 - Pentesting IMAP
161,162,10161,10162/udp - Pentesting SNMP

194,6667,6660-7000 - Pentesting IRC
264 - Pentesting Check Point FireWall-1
389, 636, 3268, 3269 - Pentesting LDAP
500/udp - Pentesting IPsec/IKE VPN
502 - Pentesting Modbus
512 - Pentesting Rexec
513 - Pentesting Rlogin
514 - Pentesting Rsh
515 - Pentesting Line Printer Daemon (LPD)
548 - Pentesting Apple Filing Protocol (AFP)
554,8554 - Pentesting RTSP
623/UDP/TCP - IPMI
631 - Internet Printing Protocol(IPP)
873 - Pentesting Rsync
1026 - Pentesting Rusersd
1080 - Pentesting Socks
1098/1099/1050 - Pentesting Java RMI - RMI-IIOP
1414 - Pentesting IBM MQ
1433 - Pentesting MSSQL - Microsoft SQL Server

1521,1522-1529 - Pentesting Oracle TNS Listener
1723 - Pentesting PPTP
1883 - Pentesting MQTT (Mosquitto)
2049 - Pentesting NFS Service
2301,2381 - Pentesting Compaq/HP Insight Manager
2375, 2376 Pentesting Docker
3128 - Pentesting Squid
3260 - Pentesting ISCSI
3299 - Pentesting SAPRouter
3306 - Pentesting Mysql
3389 - Pentesting RDP
3632 - Pentesting distcc
3690 - Pentesting Subversion (svn server)
3702/UDP - Pentesting WS-Discovery
4369 - Pentesting Erlang Port Mapper Daemon (epmd)
4786 - Cisco Smart Install
4840 - OPC Unified Architecture
5000 - Pentesting Docker Registry
5353/UDP Multicast DNS (mDNS) and DNS-SD
5432,5433 - Pentesting Postgresql
5439 - Pentesting Redshift
5555 - Android Debug Bridge
5601 - Pentesting Kibana
5671,5672 - Pentesting AMQP
5800,5801,5900,5901 - Pentesting VNC
5984,6984 - Pentesting CouchDB
5985,5986 - Pentesting WinRM
5985,5986 - Pentesting OMI
6000 - Pentesting X11
6379 - Pentesting Redis
8009 - Pentesting Apache JServ Protocol (AJP)
8086 - Pentesting InfluxDB
8089 - Pentesting Splunkd
8333,18333,38333,18444 - Pentesting Bitcoin
9000 - Pentesting FastCGI
9001 - Pentesting HSQLDB
9042/9160 - Pentesting Cassandra
9100 - Pentesting Raw Printing (JetDirect, AppSocket, PDL-datastream)
9200 - Pentesting Elasticsearch
10000 - Pentesting Network Data Management Protocol (ndmp)
11211 - Pentesting Memcache

15672 - Pentesting RabbitMQ Management
24007,24008,24009,49152 - Pentesting GlusterFS
27017,27018 - Pentesting MongoDB
44134 - Pentesting Tiller (Helm)
44818/UDP/TCP - Pentesting EthernetIP
47808/udp - Pentesting BACNet
50030,50060,50070,50075,50090 - Pentesting Hadoop
🕸
Pentesting Web
Web Vulnerabilities Methodology
Reflecting Techniques - PoCs and Polygloths CheatSheet

2FA/OTP Bypass
Account Takeover
Browser Extension Pentesting Methodology

Bypass Payment Process
Captcha Bypass
Cache Poisoning and Cache Deception
Clickjacking
Client Side Template Injection (CSTI)
Client Side Path Traversal
Command Injection
Content Security Policy (CSP) Bypass

Cookies Hacking

CORS - Misconfigurations & Bypass
CRLF (%0D%0A) Injection
CSRF (Cross Site Request Forgery)
Dangling Markup - HTML scriptless injection

Dependency Confusion
Deserialization

Domain/Subdomain takeover
Email Injections
File Inclusion/Path traversal

File Upload

Formula/CSV/Doc/LaTeX/GhostScript Injection
gRPC-Web Pentest
HTTP Connection Contamination
HTTP Connection Request Smuggling
HTTP Request Smuggling / HTTP Desync Attack

HTTP Response Smuggling / Desync
Upgrade Header Smuggling
hop-by-hop headers
IDOR
Integer Overflow
JWT Vulnerabilities (Json Web Tokens)
LDAP Injection
Login Bypass

NoSQL injection
OAuth to Account takeover
Open Redirect
Parameter Pollution
Phone Number Injections
PostMessage Vulnerabilities

Proxy / WAF Protections Bypass
Race Condition
Rate Limit Bypass
Registration & Takeover Vulnerabilities
Regular expression Denial of Service - ReDoS
Reset/Forgotten Password Bypass
SAML Attacks

Server Side Inclusion/Edge Side Inclusion Injection
SQL Injection

SSRF (Server Side Request Forgery)

SSTI (Server Side Template Injection)

Reverse Tab Nabbing
Unicode Injection

WebSocket Attacks
Web Tool - WFuzz
XPATH injection
XSLT Server Side Injection (Extensible Stylesheet Language Transformations)
XXE - XEE - XML External Entity
XSS (Cross Site Scripting)

XSSI (Cross-Site Script Inclusion)
XS-Search/XS-Leaks

⛈
Cloud Security
Pentesting Kubernetes

Pentesting Cloud (AWS, GCP, Az...)

Pentesting CI/CD (Github, Jenkins, Terraform...)

😎
Hardware/Physical Access
Physical Attacks
Escaping from KIOSKs
Firmware Analysis

🦅
Reversing & Exploiting
Reversing Tools & Basic Methods

Common API used in Malware
Word Macros
Linux Exploiting (Basic) (SPA)

Exploiting Tools

Windows Exploiting (Basic Guide - OSCP lvl)
🔮
Crypto & Stego
Cryptographic/Compression Algorithms

Certificates
Cipher Block Chaining CBC-MAC
Crypto CTFs Tricks
Electronic Code Book (ECB)
Hash Length Extension Attack
Padding Oracle
RC4 - Encrypt&Decrypt
Stego Tricks
Esoteric languages
Blockchain & Crypto Currencies
🦂
C2
Salseo
ICMPsh
Cobalt Strike
✍
TODO
Other Big References
Rust Basics
More Tools
MISC
Pentesting DNS
Hardware Hacking

Radio Hacking

Burp Suite
Other Web Tricks
Interesting HTTP
Emails Vulnerabilities
Android Forensics
TR-069
6881/udp - Pentesting BitTorrent
Online Platforms with API
Stealing Sensitive Information Disclosure from a Web
Post Exploitation
Cookies Policy
Powered By GitBook