Skip to content
HackIndex logo

HackIndex

FTP Directory & File Enumeration

1 min read Jan 4, 2026

Once access is obtained, enumerate the entire file structure.

Recursive Enumeration with lftp

Dump the entire directory tree.

┌──(kali㉿kali)-[~]
└─$ lftp -u anonymous,anonymous ftp://$TARGET_IP -e "find; bye"

Detailed file/folder listings:

┌──(kali㉿kali)-[~]
└─$ lftp -u anonymous,anonymous ftp://$TARGET_IP -e "ls -lR; bye"

Shows permissions, owners, and timestamps across all subdirs.

For FTPS: Add SSL flags

┌──(kali㉿kali)-[~]
└─$ lftp -u anonymous,anonymous ftps://$TARGET_IP -e "set ssl:verify-certificate no; find; bye"

Or force TLS:

┌──(kali㉿kali)-[~]
└─$ lftp -u anonymous,anonymous ftp://$TARGET_IP -e "set ftp:ssl-force true; find; bye"

Mirror Entire Structure with wget

┌──(kali㉿kali)-[~]
└─$ wget -m --no-passive ftp://anonymous:anonymous@$TARGET_IP/

Pulls everything locally for offline review.

For FTPS:

┌──(kali㉿kali)-[~]
└─$ wget -m --no-passive --secure-protocol=TLSv1_2 ftps://anonymous:anonymous@$TARGET_IP/

Adjust protocol if needed.

Quick Downloads with curl

┌──(kali㉿kali)-[~]
└─$ curl -O ftp://anonymous:anonymous@$TARGET_IP/*

Or recursive:

┌──(kali㉿kali)-[~]
└─$ curl -r ftp://anonymous:anonymous@$TARGET_IP/ --create-dirs -o "local/#1"

For FTPS:

┌──(kali㉿kali)-[~]
└─$ curl --ssl-reqd ftp://anonymous:anonymous@$TARGET_IP/

Focus on writable directories and unusual files during review.