Hack the Route Start free Open app Network services
RDP
Remote graphical login on TCP 3389: the client negotiates a security layer, then runs the desktop inside TLS.
RDP (Remote Desktop Protocol, TCP 3389) gives a remote graphical session — the screen, keyboard and mouse of
another machine. The connection opens with an X.224 negotiation that carries a mstshash cookie (the user name) and
the security layers the client supports: Standard RDP Security, TLS, or CredSSP / Network Level Authentication
(NLA), which authenticates the user before a session is built. The server picks one; for TLS or NLA the rest of the
session runs inside TLS. The mstshash cookie and that negotiation identify RDP in a capture. An RDP port open to the
internet is a common attack surface, so it belongs behind a VPN or NLA.