known port assignments and vulnerabilities
threat/application/port search:
| Port(s) | Protocol | Service | Details | Source |
|---|
| 2121 | tcp,udp | scientia-ssdb | FTP proxy uses port 2121 (TCP). A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attackers to access the FTP server on port 2121, and upload files or list directories, by entering these credentials.
References: [CVE-2018-11311], [EDB-44656] Backdoor.Win32.Burbul.b / Anonymous Logon - backdoor Burbul.b listens on TCP port 2121 allowing anonymous logon credentials to access the infected host E.g. USER anonymous PASS anonymous.
References: [MVID-2021-0093] Worm.Win32.Busan.k / Insecure Communication Protocol - Busan.k launches a windows cmd console on the infected host so that it can send and receive messages back and forth over TCP port 2121. The worm uses unencrypted plaintext socket communication allowing anyone who can sniff network traffic to read any communications sent or retrieved. This can disclose sensitive information to third-party well positioned attackers.
References: [MVID-2021-0185] Backdoor.Win32.Hupigon.aejq / Port Bounce Scan - the malware listens on TCP port 2121, its FTP component accepts any username/password credentials. Third-party attackers who successfully logon can abuse the backdoor FTP server as a man-in-the-middle machine allowing PORT Command bounce scan attacks using Nmap. This vulnerability allows remote attackers to abuse your system and discreetly conduct network port scanning. Victims will then think these scans are
originating from the infected system running the afflicted malware FTP Server and not you.
References: [MVID-2021-0330] Backdoor.Win32.Hupigon.aejq / Authentication Bypass RCE - the malware runs an FTP server on TCP port 2121. Third-party attackers who can reach infected systems can logon using any username/password combination. Intruders may then upload executables using ftp PASV, STOR commands, this can result in remote code execution.
References: [MVID-2021-0329] Backdoor.Win32.Prorat.lkt / Weak Hardcoded Password - the ProSpy Server V1.9 malware runs an FTP component that listens on TCP port 2121. The FTP server requires authentication for remote user access. However, the username and password both use the word "special" which is both weak and hardcoded in plaintext within the executable.
References: [MVID-2021-0360] Backdoor.Win32.Agent.Amt / Authentication Bypass - The malware can run an FTP server which listens on TCP port 2121. Third-party attackers who can reach infected systems can logon using any username/password combination. Intruders can then upload executables using ftp PASV, STOR commands, this can result in remote code execution.
References: [MVID-2024-0673] SCIENTIA-SSDB (IANA official) | SG |
| 2121 | tcp | ccproxy-ftp | CCProxy FTP Proxy | Nmap |
| 2121 | tcp,udp | scientia-ssdb | SCIENTIA-SSDB | IANA |
| jump to: 
|
« back to SG Ports
External Resources
SANS Internet Storm Center: port 2121
Notes:
Port numbers in computer networking represent communication endpoints. Ports are unsigned 16-bit integers (0-65535) that identify a specific process, or network service. IANA is responsible for internet protocol resources, including the registration of commonly used port numbers for well-known internet services.
Well Known Ports: 0 through 1023.
Registered Ports: 1024 through 49151.
Dynamic/Private : 49152 through 65535.
TCP ports use the Transmission Control Protocol, the most commonly used protocol on the Internet and any TCP/IP network. TCP enables two hosts to establish a connection and exchange streams of data. TCP guarantees delivery of data and that packets will be delivered in the same order in which they were sent. Guaranteed communication/delivery is the key difference between TCP and UDP.
UDP ports use the Datagram Protocol. Like TCP, UDP is used in combination with IP (the Internet Protocol) and facilitates the transmission of datagrams from one computer to applications on another computer, but unlike TCP, UDP is connectionless and does not guarantee reliable communication; it's up to the application that received the message to process any errors and verify correct delivery. UDP is often used with time-sensitive applications, such as audio/video streaming and realtime gaming, where dropping some packets is preferable to waiting for delayed data.
When troubleshooting unknown open ports, it is useful to find exactly what services/processes are listening to them. This can be accomplished in both Windows command prompt and Linux variants using the "netstat -aon" command. We also recommend runnig multiple anti-virus/anti-malware scans to rule out the possibility of active malicious software. For more detailed and personalized help please use our forums.
Please use the "Add Comment" button below to provide additional information or comments about port 2121. Post your review/comments |
|
FAQs
When accessing the FTP server through a NAT server, users must use port 2121. By default, port 21 is used for FTP packets. The FTP server cannot identify the FTP packets that use port 21. In this case, you need to map port 2121 to the FTP protocol.
Is 21 TCP or UDP? ›
Well-known ports
| Port | TCP | Description |
|---|
| 21 | Yes | File Transfer Protocol (FTP) control (command) |
| 22 | Yes | Secure Shell (SSH), secure logins, file transfers (scp, sftp) and port forwarding |
| 23 | Yes | Telnet protocol—unencrypted text communications |
| 25 | Yes | Simple Mail Transfer Protocol (SMTP), used for email routing between mail servers |
127 more rowsPort 21 is for the control channel, and port 20 is for the data channel. Learn how these two channels are used. You may already know that, when FTP commands cross the wire, they use TCP port 21 by default. You may also know that port 20 is assigned to the FTP data channel by default.
What are TCP and UDP ports? ›
Transmission control protocol (TCP) and user datagram protocol (UDP) are foundational pillars of the internet, enabling different types of data transmission from a network source to the destination. TCP is more reliable, while UDP prioritizes speed and efficiency.
Is port 21 a secure port? ›
For example, legacy FTP traffic that is transmitted over TCP port 21 is not a secure protocol. Files, credentials, and other information traversing FTP are transmitted in cleartext with no encryption. We often hear about the encryption used by the bad guys concerning ransomware.
Is port 21 vulnerable? ›
TCP port 21 is the default port used by File Transfer Protocol (FTP) to transfer files between systems over a network. An unrestricted inbound access to this port can allow attackers to connect to the FTP server and potentially exploit vulnerabilities, leading to unauthorized access or data exfiltration.
Why use UDP instead of TCP? ›
TCP is best used for direct communication in which a reliable connection is needed, such as web browsing, email, text messaging, and file transfers. UDP is best used for live and real-time data transmission when speed is more important than reliability.
Which port is used for UDP? ›
The most common UDP packets—DNS registrations and name-resolution queries—are sent to port 53.
What services use UDP? ›
Applications. Numerous key Internet applications use UDP, including: the Domain Name System (DNS), the Simple Network Management Protocol (SNMP), the Routing Information Protocol (RIP) and the Dynamic Host Configuration Protocol (DHCP).
Is SFTP port 21 or 22? ›
Since SFTP runs over the SSH protocol as a subsystem, SFTP uses port 22 by default. The SSH server at port 22 listens for client requests. The port number can be changed, if desired, for testing or other reasons.
FTP uses port 21 for the command port and port 20 for the data port. In addition to ports 21 and 20, FTP can be configured to use a range of passive ports for data transfer, typically between 1024 and 65535.
Why is port 20 not used for FTP anymore? ›
As there is no session concept in FTP, using a single port, let say 20, will introduce an ambiguity when multiple clients connected, as server can't match a client to a file. To overcome this limitation, there is dedicated port for each transfer.
How do I know if a port is TCP or UDP? ›
Use the lsof command, a variant of the netstat -af command to identify TCP sockets that are in the LISTEN state and idle UDP sockets that are waiting for data to arrive.
What are 3 main differences between TCP and UDP? ›
What is the main difference between TCP and UDP?
| TCP | UDP |
|---|
| Reliability | High | Lower |
| Speed | Lower | High |
| Transfer method | Packets are delivered in a sequence | Packets are delivered in a stream |
| Error detection and correction | Yes | No |
2 more rowsSep 26, 2023
Although two applications connecting to the same port number might do a similar task, TCP and UDP ports are different. They're independent of each other.
What listens on port 21? ›
File Transfer Protocol (FTP) is one of the oldest Internet protocols. FTP servers open their machine's port 21 and listen for incoming client connections. FTP clients connect to port 21 of remote FTP servers to initiate file transfer operations.
What is the port that MTA use? ›
MTA mode uses port 25 as normal. Cause of reicipent filter with callout needed, this is not working on smtp port 25, cause of exchange implementation.
Which one of the following protocols uses port 21? ›
The server protocol interpreter (server-PI) listenson the special well-known TCP port reserved for FTP control connections: port 21. The user-PI initiates the connection by opening a TCP connection from the userdevice to the server on this port. It uses an ephemeral port number as its sourceport in the TCP connection.
What is port 20022 used for? ›
RMS Connect uses the following IP address: 18.192. 27.240 and the ports provided in the table below.
| Protocol | Port number | Service |
|---|
| TCP | 20022 | Remote SSH |
| TCP | 20080 | Remote HTTP(S) |
| TCP | 20100 | Remote SFTP |
| TCP | 20120 | Remote Telnet |
1 more rowJan 11, 2024
Home » Ports Database » Port Details 