Ryan Zhang's Blog
Security Checks Giving You a Headache? Save This Complete Port and File-Upload Blocklist!
Translation Notice
This article was originally written in Chinese and translated into English with the assistance of AI. The translation has been reviewed and edited for clarity, accuracy, and readability. Please refer to the original source where necessary, especially for technical terms, commands, configuration details, and proper nouns.
Do major security assessments leave you busy and anxious? Which ports should be closed, and how should web security be configured? Don’t worry—we have prepared a practical solution. This article collects high-risk ports and file extensions that must be blocked; bookmarking it should be enough.
1. High-Risk Ports That Must Be Closed
Core principle: reduce the attack surface; close anything unnecessary.
Most firewalls now use “deny all” as their fallback policy, but many people add an “Any to Any” allow rule for convenience.
As an engineer who has only been working for a few years, I have still seen this kind of reckless configuration far too often.
All I can say is: permissive policies feel good until an incident turns troubleshooting into a nightmare. Do not wait for an incident to regret it. Check the following ports immediately and close access from any address.
Follow my WeChat public account and send “High-Risk Ports” by direct message to receive the complete list.
1.1 Remote-Access Ports
| Port | Protocol | Purpose |
|---|---|---|
| 22 | TCP | SSH |
| 23 | TCP | TELNET |
| 3389 | TCP | RDP |
| 5900-5904 | TCP | VNC |
1.2 Database Ports
1.2.1 Relational Databases
| Port | Protocol | Purpose |
|---|---|---|
| 1433 | TCP | Microsoft SQL |
| 1521 | TCP | Oracle DB |
| 3306 | TCP | MySQL/MariaDB |
| 5432 | TCP | PostgreSQL |
| 50000 | TCP | IBM DB2 |
| 5236 | TCP | Dameng |
| 54321 | TCP | Kingbase |
| 5866 | TCP | HighGo |
| 30100 | TCP | GBase |
| 2881-2882/2886 | TCP | OceanBase |
1.2.2 NoSQL Databases
| Port | Protocol | Purpose |
|---|---|---|
| 6379 | TCP | Redis |
| 27017/27018 | TCP | MongoDB |
| 9042 | TCP | Cassandra |
| 9200 | TCP | Elasticsearch |
| 5984 | TCP | CouchDB |
| 16000 | TCP | HBase |
| 8091 | TCP | Couchbase |
| 8086 | TCP | InfluxDB |
| 9042 | TCP | ScyllaDB |
1.2.3 Graph Databases
| Port | Protocol | Purpose |
|---|---|---|
| 7687 | TCP | Neo4j |
| 8529 | TCP | ArangoDB |
| 14240 | TCP | TigerGraph |
| 8080 | TCP | DGraph |
1.2.4 Vector Databases
| Port | Protocol | Purpose |
|---|---|---|
| 19530 | TCP | Milvus |
| 8080 | TCP | Weaviate |
| 6333 | TCP | Qdrant |
| 8000 | TCP | Chroma |
1.2.5 Database Administration Tools
| Port | Protocol | Purpose |
|---|---|---|
| 80/443 | TCP | phpMyAdmin |
| 80/443 | TCP | pgAdmin |
| 80/443 | TCP | Adminier |
| 8080 | TCP | Bytebase |
1.3 File-Sharing Ports
| Port | Protocol | Purpose |
|---|---|---|
| 21 | TCP | FTP |
| 139/445 | TCP | SMB |
| 593 | TCP | AFP |
| 2049 | TCP | NFS |
1.4 Other High-Risk Ports
| Port | Protocol | Purpose |
|---|---|---|
| 135/136/137/138 | TCP/UDP | Windows RPC |
| 139/445 | TCP/UDP | SMB |
| 161 | TCP/UDP | SNMP |
1.5 Ports with Many Known Vulnerabilities
| Port | Protocol | Purpose |
|---|---|---|
| 8848 | TCP | Nacos |
| 3888/2181 | TCP | Zookpeer |
| 9001 | TCP | Supervisor |
| 7077 | TCP | Spark |
| 9092 | TCP | Kafka |
| 7001 | TCP | WebLogic |
2. File Extensions That Must Be Blocked
Ineffective file-type validation is equivalent to handing over system execution privileges. The key principle is to validate not only the extension but also the file content and type. The following high-risk types must be blocked on both the frontend and backend to prevent malicious execution.
2.1 System Executables and Scripts
Risk: these files can execute commands directly on servers or users’ computers and are the highest-risk category.
- Windows: .exe, .msi, .com, .scr, .bat, .cmd, .ps1, .vbs, .vbe
- Linux: .sh
- Cross-platform: .jar
2.2 Web-Interpretable Script Files
Risk: once uploaded to a web directory and accessed, the server may execute the code, creating a web shell and compromising server privileges.
- PHP: .php, .php3, .php4, .php5, .php6, .php7, .phtml, .phps, .phar
- ASP.NET: .asp, .aspx, .asa, .asax, .ascx, .ashx, .asmx
- JSP: .jsp, .jspx, .jspf
- Other languages: .py, .pl, .cgi, .cfm, .cfml
2.3 Configuration and Web-Attack Files
Risk: these files can overwrite server configuration, leak information, or launch other attacks.
- Apache: .htaccess can rewrite rules and cause arbitrary files to be interpreted and executed.
- Configuration files: .ini, .conf, .config may contain sensitive information or expose configuration.
- Markup languages:
- .xml: may introduce XXE (XML External Entity) injection risks.
- .html, .htm, .svg: SVG and HTML can embed JavaScript for XSS attacks.
2.4 Disguised Dangerous Files
Risk: other extensions may be incorrectly associated with executable programs by the system.
- Disguised files: .pif, .lnk (Windows shortcut), .inc (often used as a PHP include file)
Support & Share
If this article helped you, please share or support!
