FTP (File Transfer Protocol) serves files on TCP 21 using a cleartext control channel and separate data connections (active or passive). Its age shows in its security: credentials and data travel unencrypted, anonymous access is a built-in feature frequently left enabled, and the PORT command enables the bounce technique that turns the server into a scan proxy. The surface is therefore anonymous access, brute force against the plaintext login, the bounce quirk, and passive capture of credentials and files from the unencrypted stream.
nmap -p21 --script ftp-anon,ftp-syst,ftp-bounce <target>
ftp <target> # interactive; try anonymous first
Subtopics#
- Anonymous access: the built-in anonymous login.
- Credential brute force: attacking the plaintext login.
- FTP bounce scan: proxying port scans through the server.