Skip to content
HackIndex.io

FTP Directory & File Enumeration

3 min read Created Dec 29, 2025 Last updated Aug 11, 2026

Once access is obtained, enumerate the entire file structure. Even a shallow FTP tree can contain configuration files, backups, or credential stores. Automated recursive tools save time over manual directory traversal.

  • lftp find/ls -lR dump the full directory tree with permissions, owners, and timestamps for write-point identification.
  • wget -m mirror the entire FTP structure locally for offline grep through credentials and configuration files.
  • FTPS support add SSL flags or set ftp:ssl-force for servers requiring TLS negotiation.
  • curl quick downloads grab single files or listings without entering an interactive session.

Recursive Enumeration with lftp

Dump the entire directory tree.

┌──(kali㉿kali)-[~]
└─$ lftp -u anonymous,anonymous ftp://$TARGET_IP -e "find; bye"

Detailed file/folder listings:

Use this over the plain find output when ownership matters. Check for files owned by service accounts or root, as these can reveal what processes write to the tree. World-readable files owned by restricted users are worth downloading immediately.

┌──(kali㉿kali)-[~]
└─$ lftp -u anonymous,anonymous ftp://$TARGET_IP -e "ls -lR; bye"

The listing shows permissions, owners, and timestamps across all subdirectories. Look for directories with write bits set for others; these are potential upload points. Check timestamps for recently modified files, as active uploads or drops show up there. Owner names can hint at the application stack running on the server.

For FTPS: Add SSL flags

┌──(kali㉿kali)-[~]
└─$ lftp -u anonymous,anonymous ftps://$TARGET_IP -e "set ssl:verify-certificate no; find; bye"

Use TLS forcing when the server supports STARTTLS on the plain FTP port. If the server rejects SSL but announces TLS capability in its banner, this flag reaches it without switching to the FTPS URI scheme.

┌──(kali㉿kali)-[~]
└─$ lftp -u anonymous,anonymous ftp://$TARGET_IP -e "set ftp:ssl-force true; find; bye"

Mirror Entire Structure with wget

wget with -m recurses the entire FTP tree and preserves the directory structure locally. Use --no-passive when the server sits behind NAT and requires active mode. The resulting local copy lets you grep for secrets, diff timestamps, and review files without repeated connections to the target.

┌──(kali㉿kali)-[~]
└─$ wget -m --no-passive ftp://anonymous:anonymous@$TARGET_IP/

The mirrored copy reflects exactly what the server exposes. Grep through it for passwords, API keys, configuration snippets, and database connection strings. Timestamps in the mirror reflect server-side modification times, which can reveal recent upload activity.

For FTPS:

┌──(kali㉿kali)-[~]
└─$ wget -m --no-passive --secure-protocol=TLSv1_2 ftps://anonymous:anonymous@$TARGET_IP/

If TLSv1_2 is rejected, try --secure-protocol=TLSv1_3. Some older FTP servers only support earlier TLS versions, so adjust until the handshake succeeds.

Quick Downloads

Use these when you need a listing or a single file without mirroring the full tree. Passive mode is the default for most clients and works through most NAT and firewall configurations.

┌──(kali㉿kali)-[~]
└─$ wget -m ftp://anonymous:anonymous@$TARGET_IP/

For FTPS: curl with --ssl-reqd enforces TLS and refuses plain FTP connections. Use this when the server requires encryption but wget fails the handshake.

┌──(kali㉿kali)-[~]
└─$ curl --ssl-reqd ftp://anonymous:anonymous@$TARGET_IP/

Focus on writable directories and unusual files during review. World-writable directories are potential upload points; verify whether any server process executes files placed there. Look for backup archives, SQL dumps, .env files, and web application configuration files. Credential files like .htpasswd or config.php are common finds on misconfigured FTP servers. Files with predictable names but non-zero sizes inside otherwise empty directories are worth pulling immediately.