Skip to content
HackIndex logo

HackIndex

FTP Anonymous Access Enumeration

2 min read Jul 14, 2026

This phase determines whether unauthenticated access is possible.

Focus here is on plain FTP (port 21) and FTPS (Explicit TLS on port 21). Anonymous login works the same way once connected. SFTP (SSH-based on port 22) does not support true anonymous access—handle it under SSH enumeration.

Check Anonymous Login with Nmap

┌──(kali㉿kali)-[~]
└─$ nmap -p 21 --script ftp-anon $TARGET_IP 
PORT   STATE SERVICE
21/tcp open  ftp
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--   1 1170     924            31 Mar 28  2001 .banner
| d--x--x--x   2 root     root         1024 Jan 14  2002 bin
| d--x--x--x   2 root     root         1024 Aug 10  1999 etc
| drwxr-srwt   2 1170     924          2048 Jul 19 18:48 incoming [NSE: writeable]
| d--x--x--x   2 root     root         1024 Jan 14  2002 lib
| drwxr-sr-x   2 1170     924          1024 Aug  5  2004 pub
|_Only 6 shown. Use --script-args ftp-anon.maxlist=-1 to see all.

Reveals accessible directories and write permissions.

For FTPS (Explicit TLS): Nmap handles it automatically if the server requires TLS after AUTH, but for manual control wrap with openssl or use tools with SSL flags.

Manual Anonymous Login

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP 
Username: anonymous
Password: (blank, anonymous or any email)

For FTPS:

┌──(kali㉿kali)-[~]
└─$ openssl s_client -connect $TARGET_IP:21 -starttls ftp -quiet

Send AUTH TLS if needed, then proceed with anonymous/anonymous (or blank password).

Post-Login Enumeration

ftp > ls -al
cd <dir>
ls -al

Prioritize writable dirs (often /incoming or /upload) and search for sensitive files, backups, or creds.

References