FTP enumeration

FTP usually runs on port 21 and is old enough that its main risks haven’t changed in years: misconfigured anonymous access, and weak credentials that fall to a straightforward brute-force. There isn’t much wiggle room: either anonymous login works, weak credentials work under brute-force, or you’re waiting on a version-specific exploit.

Manual login

ftp <target_ip>
# Username: anonymous
# Password: (blank, or anything)

Nmap

nmap -sV <target_ip>                                       # server + version
nmap --script ftp-anon -p21 <target_ip>                    # anonymous login check
nmap --script ftp-brute --script-args userdb=<userdb_file> -p21 <target_ip>

Metasploit

auxiliary/scanner/ftp/ftp_version
auxiliary/scanner/ftp/anonymous
auxiliary/scanner/ftp/ftp_login       # brute-force with a credential list

Brute-forcing and exploit search

hydra -L users.txt -P passwords.txt <target_ip> ftp

searchsploit <ftp_server_and_version>     # once you have a specific version

For a version-specific example, see the vsftpd 2.3.4 backdoor.

Related

• Nmap: scan types and NSE scripts used above
• Hydra: brute-forcing logins across protocols
• searchsploit: offline exploit-db search once you have a version
• Metasploit Framework: running the auxiliary modules
• Linux FTP & SSH exploitation: vsftpd backdoor and brute-force follow-up