TFTP (Trivial File Transfer Protocol) is a deliberately minimal file-transfer protocol over UDP port 69. It has no authentication, no directory listing, and only two real operations: read a file (RRQ) and write a file (WRQ). It is used where simplicity matters, PXE network boot, router and phone firmware and configuration, backup of device configs, so the files it serves are often sensitive, and a writable TFTP server lets an attacker influence whatever device consumes those files. Because there is no auth, reaching port 69 is the only precondition.
# connect (no listing exists; you request known/guessed filenames)
tftp <target>
# tftp> get <filename> # read
# tftp> put <localfile> <remote> # write (if allowed)
# scripted
curl -s tftp://<target>/<filename> -o out
nmap -sU -p69 --script tftp-enum <target> # probe for common filenames
Subtopics#
- File read and write: reading sensitive files and writing to the server.
- Directory traversal: escaping the TFTP root with path traversal.