Port scanning

In an Active Directory domain, domain controllers can be easily spotted depending on what services they host. Each service is usually accessible specific TCP and/or UDP port(s) making the DCs stand out in the network. Here is a list of ports to look for when hunting for domain controllers.

• 53/TCP and 53/UDP for DNS
• 88/TCP for Kerberos authentication
• 135/TCP and 135/UDP MS-RPC epmapper (EndPoint Mapper)
• 137/TCP and 137/UDP for NBT-NS
• 138/UDP for NetBIOS datagram service
• 139/TCP for NetBIOS session service
• 389/TCP for LDAP
• 636/TCP for LDAPS (LDAP over TLS/SSL)
• 445/TCP and 445/UDP for SMB
• 464/TCP and 445/UDP for Kerberos password change
• 3268/TCP for LDAP Global Catalog
• 3269/TCP for LDAP Global Catalog over TLS/SSL

The nmap utility can be used to scan for open ports in an IP range.

# -sS for TCP SYN scan
# -n for no name resolution
# --open to only show (possibly) open port(s)
# -p for port(s) number(s) to scan
nmap -sS -n --open -p 88,389 $IP_RANGE