# FTP Anonymous Access Enumeration

> Enumerate FTP servers allowing anonymous login to discover exposed files, directories, and sensitive data using tools like Nmap, ftp client, and Metasploit.

- **URL:** https://hackindex.io/services/ftp/enumeration/ftp-anonymous-access-enumeration
- **Path:** FTP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ftp/enumeration.md)
- **Published:** 2025-12-29
- **Updated:** 2026-07-14

Anonymous FTP allows unauthenticated login using the username `anonymous` with any password, typically a blank string or an email address. Many legacy servers and some embedded devices still enable it by default. The goal is to confirm whether anonymous login is accepted and what is reachable without credentials.

This phase covers plain FTP (port 21) and FTPS with Explicit TLS (also port 21). Anonymous login behaves identically on both once the connection is established. SFTP runs over SSH on port 22 and does not support anonymous access. Handle it under SSH enumeration instead.

- **Nmap ftp-anon script** detect anonymous login and list accessible files, flagging writable directories.
- **Manual login** connect with username anonymous and a blank password to verify access and map the directory tree.
- **FTPS variant** test both plain FTP and AUTH TLS negotiation, as some servers accept anonymous on either channel.
- **Post-login enumeration** run ls -al in every accessible directory to find hidden files, credentials, and write permissions.

## Check Anonymous Login with Nmap

```bash
nmap -p 21 --script ftp-anon $TARGET_IP
# PORT   STATE SERVICE
# 21/tcp open  ftp
# | ftp-anon: Anonymous FTP login allowed (FTP code 230)
# | -rw-r--r--   1 1170     924            31 Mar 28  2001 .banner
# | d--x--x--x   2 root     root         1024 Jan 14  2002 bin
# | d--x--x--x   2 root     root         1024 Aug 10  1999 etc
# | drwxr-srwt   2 1170     924          2048 Jul 19 18:48 incoming [NSE: writeable]
# | d--x--x--x   2 root     root         1024 Jan 14  2002 lib
# | drwxr-sr-x   2 1170     924          1024 Aug  5  2004 pub
# |_Only 6 shown. Use --script-args ftp-anon.maxlist=-1 to see all.
```

The Nmap output shows the directory listing visible to anonymous users and flags writable directories as `[NSE: writeable]`. A writable directory means you can upload files without credentials. A writable `incoming` or `upload` directory is worth noting for the exploitation phase. By default the script shows only six entries. Pass `--script-args ftp-anon.maxlist=-1` to list everything.

For FTPS (Explicit TLS), Nmap handles the `AUTH TLS` negotiation automatically in most cases. If the scan returns inconclusive results, verify with an openssl connection directly.

## Manual Anonymous Login

```bash
ftp $TARGET_IP
# Username: anonymous
# Password: (blank, anonymous or any email)
```

FTPS with Explicit TLS upgrades the control channel after the initial connection. The `-starttls ftp` flag sends the `AUTH TLS` command and negotiates TLS before any credentials pass over the wire.

```bash
openssl s_client -connect $TARGET_IP:21 -starttls ftp -quiet
```

If the server requires explicit TLS negotiation, send `AUTH TLS` at the raw FTP prompt before entering credentials. Some servers accept anonymous logins without requiring TLS even when it is available, so try both paths if one fails.

Once logged in, map the directory tree before downloading anything. Note which directories you can read and which you cannot.

## Post-Login Enumeration

```bash
ls -al
cd <dir>
ls -al
```

Run `ls -al` to reveal hidden files starting with a dot. Recurse into every accessible directory. Check file timestamps: recent files suggest the share is actively used, which increases the likelihood that credentials or configuration are present.

Writable directories are particularly useful during exploitation. You can stage a payload or a test file to confirm write access before committing to an upload. Files worth retrieving immediately: configuration files, credential stores, database dumps, `.env` files, private keys, scripts, and archives. If active mode connections are refused, switch to passive mode with the `passive` command at the FTP prompt.

## References

- [NMAP ftp-anon script](https://nmap.org/nsedoc/scripts/ftp-anon.html) - NMAP FTP anonymous check NSE script