Skip to content
HackIndex.io

FTP Anonymous Access Enumeration

3 min read Created Dec 29, 2025 Last updated Jul 14, 2026

Anonymous FTP allows unauthenticated login using the username anonymous with any password, typically a blank string or an email address. Many legacy servers and some embedded devices still enable it by default. The goal is to confirm whether anonymous login is accepted and what is reachable without credentials.

This phase covers plain FTP (port 21) and FTPS with Explicit TLS (also port 21). Anonymous login behaves identically on both once the connection is established. SFTP runs over SSH on port 22 and does not support anonymous access. Handle it under SSH enumeration instead.

  • Nmap ftp-anon script detect anonymous login and list accessible files, flagging writable directories.
  • Manual login connect with username anonymous and a blank password to verify access and map the directory tree.
  • FTPS variant test both plain FTP and AUTH TLS negotiation, as some servers accept anonymous on either channel.
  • Post-login enumeration run ls -al in every accessible directory to find hidden files, credentials, and write permissions.

Check Anonymous Login with Nmap

┌──(kali㉿kali)-[~]
└─$ nmap -p 21 --script ftp-anon $TARGET_IP 
PORT   STATE SERVICE
21/tcp open  ftp
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--   1 1170     924            31 Mar 28  2001 .banner
| d--x--x--x   2 root     root         1024 Jan 14  2002 bin
| d--x--x--x   2 root     root         1024 Aug 10  1999 etc
| drwxr-srwt   2 1170     924          2048 Jul 19 18:48 incoming [NSE: writeable]
| d--x--x--x   2 root     root         1024 Jan 14  2002 lib
| drwxr-sr-x   2 1170     924          1024 Aug  5  2004 pub
|_Only 6 shown. Use --script-args ftp-anon.maxlist=-1 to see all.

The Nmap output shows the directory listing visible to anonymous users and flags writable directories as [NSE: writeable]. A writable directory means you can upload files without credentials. A writable incoming or upload directory is worth noting for the exploitation phase. By default the script shows only six entries. Pass --script-args ftp-anon.maxlist=-1 to list everything.

For FTPS (Explicit TLS), Nmap handles the AUTH TLS negotiation automatically in most cases. If the scan returns inconclusive results, verify with an openssl connection directly.

Manual Anonymous Login

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP 
Username: anonymous
Password: (blank, anonymous or any email)

FTPS with Explicit TLS upgrades the control channel after the initial connection. The -starttls ftp flag sends the AUTH TLS command and negotiates TLS before any credentials pass over the wire.

┌──(kali㉿kali)-[~]
└─$ openssl s_client -connect $TARGET_IP:21 -starttls ftp -quiet

If the server requires explicit TLS negotiation, send AUTH TLS at the raw FTP prompt before entering credentials. Some servers accept anonymous logins without requiring TLS even when it is available, so try both paths if one fails.

Once logged in, map the directory tree before downloading anything. Note which directories you can read and which you cannot.

Post-Login Enumeration

ftp > ls -al
ftp > cd <dir>
ftp > ls -al

Run ls -al to reveal hidden files starting with a dot. Recurse into every accessible directory. Check file timestamps: recent files suggest the share is actively used, which increases the likelihood that credentials or configuration are present.

Writable directories are particularly useful during exploitation. You can stage a payload or a test file to confirm write access before committing to an upload. Files worth retrieving immediately: configuration files, credential stores, database dumps, .env files, private keys, scripts, and archives. If active mode connections are refused, switch to passive mode with the passive command at the FTP prompt.

References