FTP enumeration

FTP, or File Transfer Protocol, is used to transfer files between a client and a server. Traditional FTP does not encrypt credentials or transferred data, so usernames, passwords and files may travel in clear text.

FTP normally uses TCP port 21 for the control connection. Traditional active FTP may use TCP port 20 for the server-side data connection. FTPS may use port 21 with explicit TLS or port 990 for implicit FTPS.

Start by confirming that the FTP service is reachable and identifying the server implementation and version. Banner and version information may reveal useful details about the software in use.

Nmap includes NSE scripts that can check anonymous access, retrieve server information and perform additional FTP enumeration.

One of the first checks against an FTP server is whether anonymous authentication is allowed. Anonymous FTP is not automatically vulnerable; the real impact depends on the files that can be accessed and whether the anonymous account has write permissions.

A common anonymous FTP login uses anonymous as the username. The password may also be anonymous, blank or an email address depending on the server configuration.

Once authenticated, enumerate available directories and files before downloading anything. FTP clients provide commands similar to basic filesystem navigation.

Interesting FTP content may include configuration files, backups, scripts, source code, documentation or exposed credentials. Download relevant files for offline analysis when authorised.

Write access is more significant than read-only access because it allows files to be created or modified. However, FTP write access does not automatically provide code execution; the impact depends on where the writable directory is used.

Determine whether the current FTP account can read, download, upload, overwrite or delete files. When write testing is authorised, use a harmless test file instead of modifying existing content.

A writable directory becomes especially interesting when it maps to another service, such as a web root, application directory or automated file-processing location. The context determines whether file upload can lead to a greater impact.

Metasploit contains auxiliary modules for FTP service detection and enumeration.

The anonymous FTP scanner checks whether the server permits anonymous authentication.

The FTP login scanner can validate username and password combinations during an authorised credential audit.

Hydra can validate FTP credentials against a target. Aggressive login attempts may trigger rate limiting, account lockouts, temporary blocking or connection throttling.

If the FTP server starts closing connections during repeated authentication attempts, this may indicate rate limiting, connection limits or another service-protection mechanism. It should not be treated as universal FTP behaviour.

In active mode, the client creates the control connection to the server, but the server initiates the data connection back toward the client. This can create problems when the client is behind NAT or restrictive firewall rules.

In passive mode, the client initiates both the control and data connections. This generally works better through NAT and firewalls and is commonly used in modern environments.

FTP is the traditional unencrypted protocol. FTPS is FTP protected with TLS. SFTP is the SSH File Transfer Protocol and runs over SSH, normally on TCP port 22. SFTP is not the same thing as FTP over SSH.

Confirm the FTP service, identify the version, capture the banner, test anonymous access, enumerate files and directories, determine read and write permissions, analyse interesting files and then validate credentials if authorised. Correlate any writable directory with other exposed services.

These are the FTP commands worth remembering during service enumeration.