# Services

> Pentest methodology per network service and protocol, each split into phases with guides.

- **URL:** https://hackindex.io/services

- [AMQP](https://hackindex.io/services/amqp.md): Message broker protocol
- [Cassandra](https://hackindex.io/services/cassandra.md): Cassandra is a distributed NoSQL database. Attackers probe open ports, enumerate keyspaces, exploit misconfigs or weak auth, extract data, and pivot using stolen credentials
- [CGMS](https://hackindex.io/services/cgms.md): Custom or legacy management service
- [Consul](https://hackindex.io/services/consul.md): Consul is a service mesh and discovery tool. Attackers enumerate services, exploit unauthenticated APIs, execute commands via health checks, escalate privileges, and move laterally through registered nodes
- [CouchDB](https://hackindex.io/services/couchdb.md): CouchDB is a NoSQL database using HTTP API. Attackers enumerate exposed ports, probe admin interfaces, exploit misconfigs, escalate via Erlang cookie, and exfiltrate JSON documents
- [DNS](https://hackindex.io/services/dns.md): DNS maps domains to IPs. Attackers probe records, zone transfers, and subdomains, then exploit misconfigs for poisoning, takeover, hijacking, tunneling, and covert exfiltration via encoded queries
- [Docker API](https://hackindex.io/services/docker-api.md)
- [Elasticsearch](https://hackindex.io/services/elasticsearch.md): Search and analytics engine
- [etcd](https://hackindex.io/services/etcd.md): Distributed key-value store used in Kubernetes clusters. Attackers probe for unauthenticated APIs, extract secrets and credentials, tamper with cluster configs, and pivot to other nodes
- [Finger](https://hackindex.io/services/finger.md): User information lookup service
- [FTP](https://hackindex.io/services/ftp.md): FTP file transfer service. Attackers check banners, anonymous access, writable dirs, cleartext creds, CVEs, and backdoors, then exploit for shells, brute-force, or data exfiltration
- [Git daemon](https://hackindex.io/services/git-daemon.md): Anonymous Git serving
- [Grafana](https://hackindex.io/services/grafana.md): Grafana is an analytics dashboard platform. Attackers enumerate versions, exploit CVEs for RCE or auth bypass, steal credentials from data sources, and pivot via backend integrations
- [Hadoop HDFS](https://hackindex.io/services/hadoop-hdfs.md): Distributed file system for big data clusters. Attackers enumerate exposed web UIs, exploit misconfigs for unauthenticated access, extract stored data, and pivot through cluster nodes
- [Hosts](https://hackindex.io/services/hosts.md): Hosts covers attacking network systems from recon and port scanning to exploitation, post-exploitation, privilege escalation, lateral movement, persistence, and data exfiltration via ICMP
- [HTTP/HTTPS](https://hackindex.io/services/web.md): HTTP/HTTPS pentesting covers recon, enum, vuln discovery, and exploitation of web apps via XSS, SQLi, RCE, LFI, SSRF, JWT flaws, file uploads, and more through to exfil and persistence
- [IIS](https://hackindex.io/services/iis.md): IIS is Microsoft's web server. Attackers probe for version leaks, short name flaws, WebDAV misconfigs, ASPX shell upload, auth bypass, and post-access token abuse for escalation
- [IKE](https://hackindex.io/services/ike.md): IKE negotiates IPsec VPN tunnels. Attackers enumerate transform sets, fingerprint vendors, exploit aggressive mode to capture PSKs, and crack weak credentials to gain VPN access
- [IMAP](https://hackindex.io/services/imap.md): Email access protocol syncing messages with server.
- [IPP / CUPS](https://hackindex.io/services/ipp-cups.md): Network printing stack
- [IRC](https://hackindex.io/services/irc.md): IRC is a chat protocol. Attackers enumerate channels and users, exploit server flaws, use it as a C2 channel, exfiltrate data, and establish persistence via bots or backdoors
- [Java RMI / JMX](https://hackindex.io/services/java-rmi-jmx.md): Java remote management
- [Jenkins](https://hackindex.io/services/jenkins.md): Jenkins is a CI/CD automation server. Attackers enumerate exposed dashboards, exploit script consoles for RCE, escalate privileges, move laterally via pipelines, and exfiltrate credentials or secrets
- [Kerberos](https://hackindex.io/services/kerberos.md): Kerberos is AD's auth protocol. Attackers enumerate users, SPNs, and KDCs, then exploit via AS-REP roasting, Kerberoasting, ticket forging, delegation abuse, and ccache reuse for lateral movement
- [LDAP](https://hackindex.io/services/ldap.md): LDAP directory service attacks covering anonymous binds, injection, enumeration of users and groups, relay attacks, credential extraction, and leveraging AD trust paths for lateral movement
- [Memcached](https://hackindex.io/services/memcached.md): Memcached is a distributed memory cache. Attackers enumerate keys, dump cached data and session tokens, and test for unauthenticated access and UDP amplification vulnerabilities
- [MongoDB](https://hackindex.io/services/mongodb.md): MongoDB NoSQL database pentesting covering auth misconfigs, operator injection, unauth data access, CVE exploitation, credential looting, and exfiltration of stored collections and sensitive documents
- [MQTT](https://hackindex.io/services/mqtt.md): MQTT is a lightweight IoT messaging protocol. Attackers enumerate brokers and topics, probe for missing auth and plaintext transport, then exploit anonymous access to read or inject messages and harvest credentials
- [MSRPC](https://hackindex.io/services/msrpc.md): Windows remote procedure calls
- [MSSQL](https://hackindex.io/services/mssql.md): MSSQL is Microsoft's relational DB server. Attackers enumerate instances, exploit weak creds and xp_cmdshell for RCE, escalate to SYSTEM, pivot via linked servers, and exfiltrate stored data
- [MySQL](https://hackindex.io/services/mysql.md): MySQL attack coverage spanning version fingerprinting, user grants, default creds, FILE privilege abuse, UDF exploitation, hash cracking, config harvesting, and data exfiltration via dumps and file output
- [NetBIOS](https://hackindex.io/services/netbios.md): Windows legacy naming
- [NFS](https://hackindex.io/services/nfs.md): NFS file share protocol. Attackers enumerate exports, mount shares, abuse UID trust and no_root_squash to access files, plant SUID binaries, escalate privileges, and exfiltrate data
- [NTP](https://hackindex.io/services/ntp.md): Time synchronization service
- [Oracle](https://hackindex.io/services/oracle.md): Oracle DB attack coverage including TNS listener and SID enumeration, weak credential testing on default accounts, and exploitation for SQL exec, file access, and OS command execution
- [POP3](https://hackindex.io/services/pop3.md): Email retrieval protocol downloading messages locally.
- [PostgreSQL](https://hackindex.io/services/postgresql.md): PostgreSQL attack reference covering version and role enumeration, weak cred discovery, RCE via COPY TO PROGRAM and UDFs, privesc, lateral movement, persistence, and data exfiltration
- [Prometheus](https://hackindex.io/services/prometheus.md): Prometheus is a metrics monitoring system. Attackers probe exposed endpoints for sensitive data, exploit misconfigs, pivot via scraped credentials, and establish persistence through metric manipulation
- [r-services](https://hackindex.io/services/r-services.md): Legacy Unix remote login
- [RDP](https://hackindex.io/services/rdp.md): RDP remote desktop protocol attacks covering NTLM fingerprinting, BlueKeep and DejaBlue CVEs, NLA bypass, Pass-the-Hash, session hijacking via tscon, and sticky keys backdoors
- [Redis](https://hackindex.io/services/redis.md): Redis in-memory store tested for unauth access, version flaws, and keyspace secrets. Exploits include RCE via file writes, SSH key injection, cron abuse, auth bypass, and SSRF for lateral movement
- [RPCBind / Portmapper](https://hackindex.io/services/rpcbind-portmapper.md): RPC service mapper
- [Rsync](https://hackindex.io/services/rsync.md): File sync daemon
- [SMB](https://hackindex.io/services/smb.md): SMB is a Windows file and printer sharing protocol. Attackers enumerate shares, users, and domain info, then exploit misconfigs via relay, PtH, or RCE to move laterally and exfiltrate data
- [SMTP](https://hackindex.io/services/smtp.md): Mail transfer service for sending emails.
- [SNMP](https://hackindex.io/services/snmp.md): Network monitoring and management
- [SSH](https://hackindex.io/services/ssh.md): SSH remote access protocol. Attackers target banners, auth methods, weak keys, legacy crypto, misconfigs, and CVEs, then pivot via agent forwarding, tunneling, and key reuse for persistence and exfil
- [Telnet](https://hackindex.io/services/telnet.md): Telnet is a plaintext remote access protocol. Attackers grab banners, brute force weak creds, intercept traffic via MITM, then pivot internally using gained shell access
- [TFTP](https://hackindex.io/services/tftp.md): Simple file transfer service
- [Tomcat / AJP](https://hackindex.io/services/tomcat-ajp.md): Apache Tomcat web server using AJP connector. Attackers fingerprint versions, exploit Ghostcat for file read, discover exposed Manager panels, and deploy malicious WAR files for RCE
- [VNC](https://hackindex.io/services/vnc.md): VNC remote desktop protocol testing covering auth probing, version fingerprinting, brute force, session hijacking, hash decryption, and post-access lateral movement and persistence via reverse callbacks
- [WinRM](https://hackindex.io/services/winrm.md): WinRM is Windows remote management over HTTP/HTTPS. Attackers probe auth, brute force creds, gain remote shells, bypass CLM, escape JEA, and move laterally across Windows environments
- [X11](https://hackindex.io/services/x11.md): X11 is a display server protocol. Attackers probe open ports, check for auth bypass, capture keystrokes or screenshots, pivot via display access, and maintain persistence through xhost misconfigs
- [Zabbix](https://hackindex.io/services/zabbix.md): Zabbix is a network monitoring platform. Attackers enum its web UI, exploit weak creds or CVEs, abuse agent configs, escalate via scripts, and pivot using stored host credentials