During a penetration test, a tester discovers TCP port 3306 open on a Linux server accessible from a...

Question

During a penetration test, a tester discovers TCP port 3306 open on a Linux server accessible from a development workstation. The server is in the production network segment. What service uses TCP 3306, what data can the tester potentially access, and what is the correct network control to mitigate this?

Accepted Answer

TCP 3306 is MySQL's default port. If accessible, the tester can attempt to authenticate to the MySQL server and potentially access all databases, tables, stored procedures, and credentials. Mitigation: bind MySQL to 127.0.0.1 (localhost only) or restrict access via firewall rules to only the application server IPs that need database access.

Answer

TCP 3306 is the PostgreSQL port; it is safe to expose because PostgreSQL requires SSL certificates.

Answer

TCP 3306 is used by Microsoft SQL Server for named instance discovery.

Answer

TCP 3306 is the Oracle Database port; MySQL uses port 1521. HTTP/3 runs over TCP 80 because QUIC requires TCP's congestion control underneath. POP3S uses TCP 993, sharing a TLS listener with IMAPS on the same socket. DoT (DNS over TLS) uses port 443, indistinguishable from HTTPS by design. Jitter describes the total time a packet spends in flight from source to destination

What service uses TCP 3306, what data can the tester potentially access, and what is the correct network control to mitigate this?

Where this fits in the Network Fundamentals exam

One question down. Thousands to go.

What service uses TCP 3306, what data can the tester potentially access, and what is the correct network control to mitigate this?

Where this fits in the Network Fundamentals exam

More free Common Protocols & Ports questions

One question down. Thousands to go.