Port Scanning & Network Perimeter Security
Auditing Your Public Attack Surface
Every open TCP port represents a potential entry point for attackers scanning the internet. Unintentionally exposed database ports (e.g. MySQL 3306, PostgreSQL 5432) or remote management interfaces (SSH 22, RDP 3389) are prime targets for automated brute-force botnets.
Common High-Risk Ports Tested
- Port 21 (FTP): Legacy unencrypted file transfer protocol. Should be disabled in favor of SFTP.
- Port 22 (SSH): Remote administration. Should enforce key-based authentication and rate limiting.
- Port 3306 (MySQL) & 5432 (Postgres): Databases should never be exposed directly to the public internet; bind them to
127.0.0.1or access via private VPN. - Port 3389 (RDP): Windows Remote Desktop. Highly targeted by ransomware groups.
❓ Frequently Asked Questions
Why should database ports not be open publicly?
Exposing database ports allows anyone on the internet to attempt credential brute forcing and exploit unpatched zero-day vulnerabilities in the database engine.