Plaintext Protocols: What Attackers See

HTTP transmits all data as plain ASCII text with no encryption. When you submit a login form over HTTP, the browser sends a POST request containing your username and password in cleartext. Anyone on the same network segment, or any router between you and the server, can read the complete request including credentials, session cookies, and any sensitive form data.

Telnet was the standard remote terminal protocol before SSH. Every keystroke typed in a Telnet session travels to the server as a single unencrypted TCP packet. An attacker capturing network traffic sees not just the username and password at login but every command typed and every line of output displayed, enabling complete session hijacking with no cryptographic barriers.

FTP authenticates with a USER command followed by a PASS command, both sent as plaintext on TCP port 21. A packet capture of an FTP login shows the exact credentials. Even if the file transfer channel is encrypted with FTPS, the initial authentication exchange reveals the password to any observer. Legacy FTP servers are commonly found in corporate environments and represent easy credential harvesting targets.

POP3 (port 110) and IMAP (port 143) without TLS send email credentials and full message content in plaintext. When a user opens their email client on a coffee shop Wi-Fi with an unencrypted mail server configuration, every email they download is readable to any other device on the network. Upgrading to POP3S (port 995) and IMAPS (port 993) uses TLS from the connection start.

Database servers like MySQL (port 3306) and PostgreSQL (port 5432) support unencrypted connections by default. Application servers that connect to the database without requiring SSL send queries and their results, including sensitive personal data, as plaintext across the network. Internal networks are often considered trusted, but attackers who gain any foothold can immediately start sniffing database traffic.

LDAP (Lightweight Directory Access Protocol) on port 389 transmits directory queries and authentication in plaintext. Corporate environments using Active Directory for authentication may have LDAP bind operations exposing usernames and passwords on the internal network. LDAPS on port 636 uses TLS, and STARTTLS on port 389 can upgrade the connection, but these are not always enforced.

Redis by default listens on port 6379 without authentication and without TLS. A Redis instance exposed to the network without a password allows any client to read all stored keys, execute arbitrary commands, and potentially write configuration files. Until Redis 6.0 (2020) added TLS support, all Redis traffic including cache data and session tokens was completely exposed on the wire.

Memcached, a widely used caching layer, has no built-in authentication mechanism and sends all data in plaintext ASCII text over TCP port 11211. Developers typically rely on network firewalls to restrict access, but misconfigured Memcached instances exposed to the internet have been used in amplification DDoS attacks and data theft. All cached content including session data and API responses is visible to anyone who can reach the port.

Traditional syslog uses UDP port 514 with no authentication and no encryption. System logs sent over the network can be read, modified, or forged by anyone on the path. An attacker who can intercept syslog traffic can read security events in real time or inject false log entries to cover their tracks. RFC 5425 defines syslog over TLS, but many systems still use the legacy plaintext protocol.

From a single network vantage point, an attacker capturing plaintext protocol traffic gains a comprehensive view of the environment. They see usernames and passwords for multiple services, session tokens that can be replayed without the original password, sensitive data being transferred, and the internal architecture of the network. This information can be gathered passively with no interaction with the target systems.

Despite decades of knowledge about plaintext risks, unencrypted protocols persist due to legacy systems that cannot be upgraded, configuration complexity in large environments, performance concerns on high-throughput internal links, and the assumption that internal networks are trusted. Network segmentation and zero-trust architecture principles push back against this assumption by treating internal traffic with the same scrutiny as external traffic.

Which of the following protocol and port combinations transmits authentication credentials in plaintext by default?

HTTP, Telnet, FTP, POP3, IMAP, raw database connections, LDAP, Redis, Memcached, and syslog all transmit data without encryption by default. Any observer on the network path can read credentials, session tokens, and sensitive data. TLS-secured equivalents exist for all these protocols. Internal network trust assumptions are dangerous; zero-trust principles treat all traffic as potentially observable.