Exposure

RDP is routinely exposed directly to the internet on 3389, where it is continuously scanned, brute-forced, and stuffed, and it is a leading ransomware entry point. Exposure analysis finds these endpoints and assesses the transport: native RDP security and weak TLS allow machine-in-the-middle and decryption, compounding the credential and pre-auth risks.

1 min di letturaaggiornato il 5 ott 2026florianamette1 contributore
Chiedi al tuo assistente (MCP)Modifica su GitHub

RDP's biggest real-world risk is simple exposure: organizations publish 3389 to the internet for convenience, and those endpoints are perpetually scanned, brute-forced, and credential-stuffed, making exposed RDP a top ransomware initial-access vector. Exposure analysis has two parts: finding the internet-facing endpoints (directly or via search engines like Shodan), and assessing the transport security. Legacy native RDP security lacks robust server authentication, while TLS deployments remain vulnerable to interception when clients do not validate the server certificate; these weaknesses compound the already-high credential and pre-auth exposure.

bash
# find exposed RDP
nmap -p3389 --open <range>
# search-engine discovery: shodan "port:3389", masscan for breadth
# assess transport
nmap -p3389 --script rdp-enum-encryption <target>

Subtopics#

  • Internet exposure: finding and assessing internet-facing RDP.
  • Weak TLS: native RDP security and TLS weaknesses enabling MITM.

References#

PrecedenteSecurity settingsSuccessiva Internet exposure