{
  "port": 88,
  "protocol": "both",
  "service": "Kerberos",
  "oneLiner": "The Kerberos KDC — where clients get tickets, and the heartbeat of every Active Directory domain.",
  "whatItIs": "A Key Distribution Center listens on 88 and answers AS-REQ and TGS-REQ messages, handing out the ticket-granting ticket and then service tickets that authenticate users without sending passwords. Windows domain controllers, MIT krb5 KDCs, Heimdal, and FreeIPA all listen here; Windows clients try UDP first and fall back to TCP when the ticket exceeds the datagram size. On a scan, an open 88 next to 389 and 445 is a domain controller, full stop. macOS also ships a KDC for local Kerberos realms.",
  "exposure": {
    "verdict": "never",
    "note": "The KDC is the root of trust for the whole realm, and an exposed one invites offline password cracking via AS-REP roasting and pre-auth probing. Keep it internal or behind a VPN."
  },
  "checkCommand": "nc -vz TARGET 88",
  "links": [
    {
      "title": "RFC 4120 — The Kerberos Network Authentication Service (V5)",
      "url": "https://www.rfc-editor.org/rfc/rfc4120.html",
      "kind": "spec"
    },
    {
      "title": "MIT Kerberos (official project site)",
      "url": "https://web.mit.edu/kerberos/",
      "kind": "official-docs"
    },
    {
      "title": "MIT Kerberos source repository",
      "url": "https://github.com/krb5/krb5",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}