Skip to main content
Default Port: 21 File Transfer Protocol (FTP) is one of the oldest protocols still showing up on engagements, and it’s worth checking early since misconfigurations here tend to be cheap wins. It runs on port 21 by default, and a login of anonymous:anonymous is common enough that it’s always worth trying before reaching for anything else.

Active Mode

The server opens a new connection back to the client for data transfer. Often blocked by client-side firewalls since it requires an inbound connection.

Passive Mode

The client initiates both connections instead. More firewall-friendly, and the default most clients and tools fall back to today.
Always try anonymous login first, it costs nothing and is still common on misconfigured servers, printers, and NAS devices left on defaults.

​
Connecting to the Service

A handful of tools can talk to FTP directly, which is useful for a quick look before reaching for anything more structured.
If the server supports FTPS, openssl can connect and negotiate the encrypted session where a plain client would fail:
Even a basic banner grab is worth doing first. The welcome message often leaks the exact FTP daemon and version, which is enough to check for a known exploit before doing anything else.

​
Anonymous Login and Downloading

If anonymous access works, pulling everything off the server in one shot is usually faster than browsing it file by file.
-m mirrors the entire directory structure recursively. On a server with a lot of content this can take a while, worth narrowing to a specific path first if you only need a quick look.

​
Nmap Enumeration

Before touching anything manually, a handful of Nmap’s built-in FTP scripts cover most of the initial recon in one pass.
ftp-anon checks anonymous access and ftp-syst grabs system info the server exposes post-login. For checking the vsftpd backdoor specifically, or testing the FTP bounce technique below, dedicated scripts exist for both:

​
Checking for Write Access

A server that allows anonymous login but also allows writes is a much bigger finding than read-only access, since it often means dropping a webshell directly onto a web root the FTP server shares with.
If the upload succeeds and the FTP root overlaps with a website’s web root, uploading a webshell directly gets you code execution without needing any other vulnerability:
Even without a web root overlap, write access is still useful: dropping a file and checking whether it reappears elsewhere on the host (a shared mount, a sync job) can reveal connections between services that aren’t obvious from the outside.

​
FTP Bounce Attack

This is a legacy technique against old FTP daemons. Most modern servers reject it outright, but it’s cheap to test and occasionally still works on older or embedded devices.
The PORT command can be abused to make the FTP server open a connection to a third host on your behalf, effectively using the FTP server as a scanning proxy. This is useful when the FTP server sits on a network segment you can’t reach directly.
A successful bounce scan reports port states on the third host as seen by the FTP server, not by you, which is exactly what makes it useful for reaching otherwise unreachable hosts.

​
Hunting for Credentials on the Server

Once you’ve got any level of access, FTP servers used for deployment or backups often have configuration files or credentials sitting in plain sight.
Worth specifically checking for config files, backup archives, and anything named like credentials or a database dump, these show up on misconfigured FTP shares far more often than you’d expect.
lftp handles recursive searching and mirroring far better than the stock ftp client, and scripts cleanly for larger directory trees:

​
Brute Forcing

When anonymous login fails, credential spraying is the next step. Worth checking for default or weak credentials before moving on to something more involved.

​
Metasploit Modules

A few auxiliary modules cover the same ground as the manual commands above, useful when you’re already working inside msfconsole against several targets.
vsftpd 2.3.4 has a well-known backdoor baked into a specific build, if ftp_version identifies it, it’s worth checking immediately rather than enumerating further.

​
Quick Reference Tools

Hackviser: FTP

Quick-reference pentesting guide for the FTP service.

HackTricks: FTP

Deeper breakdown of FTP enumeration and exploitation techniques.
Only test FTP servers you’re authorized to assess. Even anonymous login attempts can trip alerting on a monitored target.