Directory & authenticationTCP/UDP 389, 636 Cleartext by default
Port 389, 636: LDAP
Lightweight Directory Access Protocol
Queries and modifies directories such as Active Directory. 389 is LDAP (optionally with StartTLS); 636 is LDAP over TLS. 3268/3269 serve the Global Catalog.
Secure alternative: LDAPS (636)
How attackers abuse it
- Simple binds exposing credentials in clear text.
- Anonymous or over-permissive queries enumerating users and groups.
- LDAP injection in applications that build filters from input.
- Relay attacks where signing and channel binding are off.
How to defend it
- Require LDAPS or StartTLS, plus LDAP signing and channel binding.
- Disable anonymous binds.
- Escape filter input in applications.
Exam tip
LDAPS is 636; Global Catalog is 3268 (3269 over TLS).