What is Port 3389 and How Does It Work?
Port 3389 is the default port for Microsoft Remote Desktop Protocol (RDP) GUI management sessions.
Security Vulnerabilities & Attack Vectors on Port 3389
RDP on public IPs is heavily targeted by ransomware gangs. Require NLA, change default port, or enforce VPN access.
Auditing & Scanning Port 3389 with Nmap
Run the following command to check if Port 3389 is reachable and determine service fingerprints:
nmap -p 3389 --script rdp-enum-encryption,rdp-vuln-ms12-020