Common attacks and weaknesses
- Kerberoasting and AS-REP roasting to crack service account passwords offline.
- Golden and silver tickets after compromise.
- User enumeration.
Port 88: Kerberos
Kerberos authentication, the core of Active Directory logins.
88
How Kerberos works
Directory & authenticationThe client proves who it is on port 88 and gets an answer (or a ticket) it can use with other services. Everything is encrypted: someone on the path only sees unreadable bytes.
- Transport
- TCP · UDP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- EncryptedTLS or built-in crypto
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- Directory & authentication
Is port 88 dangerous?
How to secure it
- Use long random passwords or gMSA for service accounts.
- Require pre-authentication on every account.
- Disable RC4 and monitor event IDs 4768 and 4769.
IANA registry entries for port 88
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| kerberos | 88 | TCP, UDP | Kerberos | RFC 4120 | 2022-02-18 |
// source: IANA service name and port number registry
Which program uses port 88, and is it reachable?
Linux
sudo ss -ltnup 'sport = :88' # process listening on 88
sudo lsof -nP -i :88macOS
sudo lsof -nP -i :88
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 88 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 88 netstat -ano | findstr :88
From another machine
nmap -p 88 -sV <host> sudo nmap -sU -p 88 <host> nc -zv <host> 88
Block it in the firewall
sudo ufw deny 88/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 88" -Direction Inbound -LocalPort 88 -Protocol TCP -Action Block # Windows
What is port 88 used for?
Kerberos authentication, the core of Active Directory logins.
Is port 88 TCP or UDP?
Port 88 is registered for TCP and UDP.
Is it safe to open port 88?
It is rated 6/10 (high) when exposed to the Internet. Kerberoasting and AS-REP roasting to crack service account passwords offline. Use long random passwords or gMSA for service accounts.
How do I check if port 88 is open?
On Linux run "ss -ltnup 'sport = :88'", on macOS "lsof -nP -i :88", and on Windows "netstat -ano | findstr :88" to see the local process. From another machine, "nmap -p 88 <host>" shows whether it is reachable.
Other directory & authentication ports
:389 LDAP tcp · udp · high risk :636 LDAPS tcp · udp · moderate risk :3268 Global Catalog (LDAP) tcp · udp · high risk :1812 RADIUS udp · tcp · moderate risk :31 MSG Authentication tcp · udp :49 Login Host Protocol (TACACS) tcp · udp :56 XNS Authentication tcp · udp :113 Authentication Service tcp · udp