# FTP Directory & File Enumeration

> Active FTP enumeration techniques covering anonymous access, directory traversal, file discovery, and permission analysis using tools like Nmap, Hydra, and raw FTP commands.

- **URL:** https://hackindex.io/services/ftp/enumeration/ftp-directory-file-enumeration
- **Path:** FTP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ftp/enumeration.md)
- **Published:** 2025-12-29
- **Updated:** 2026-08-11

Once access is obtained, enumerate the entire file structure. Even a shallow FTP tree can contain configuration files, backups, or credential stores. Automated recursive tools save time over manual directory traversal.

- **lftp find/ls -lR** dump the full directory tree with permissions, owners, and timestamps for write-point identification.
- **wget -m** mirror the entire FTP structure locally for offline grep through credentials and configuration files.
- **FTPS support** add SSL flags or set ftp:ssl-force for servers requiring TLS negotiation.
- **curl quick downloads** grab single files or listings without entering an interactive session.

## Recursive Enumeration with lftp

### Dump the entire directory tree.

```bash
lftp -u anonymous,anonymous ftp://$TARGET_IP -e "find; bye"
```

### Detailed file/folder listings:

Use this over the plain find output when ownership matters. Check for files owned by service accounts or root, as these can reveal what processes write to the tree. World-readable files owned by restricted users are worth downloading immediately.

```bash
lftp -u anonymous,anonymous ftp://$TARGET_IP -e "ls -lR; bye"
```

The listing shows permissions, owners, and timestamps across all subdirectories. Look for directories with write bits set for others; these are potential upload points. Check timestamps for recently modified files, as active uploads or drops show up there. Owner names can hint at the application stack running on the server.

**For FTPS**: Add SSL flags

```bash
lftp -u anonymous,anonymous ftps://$TARGET_IP -e "set ssl:verify-certificate no; find; bye"
```

Use TLS forcing when the server supports STARTTLS on the plain FTP port. If the server rejects SSL but announces TLS capability in its banner, this flag reaches it without switching to the FTPS URI scheme.

```bash
lftp -u anonymous,anonymous ftp://$TARGET_IP -e "set ftp:ssl-force true; find; bye"
```

## Mirror Entire Structure with wget

wget with `-m` recurses the entire FTP tree and preserves the directory structure locally. Use `--no-passive` when the server sits behind NAT and requires active mode. The resulting local copy lets you grep for secrets, diff timestamps, and review files without repeated connections to the target.

```bash
wget -m --no-passive ftp://anonymous:anonymous@$TARGET_IP/
```

The mirrored copy reflects exactly what the server exposes. Grep through it for passwords, API keys, configuration snippets, and database connection strings. Timestamps in the mirror reflect server-side modification times, which can reveal recent upload activity.

**For FTPS**:

```bash
wget -m --no-passive --secure-protocol=TLSv1_2 ftps://anonymous:anonymous@$TARGET_IP/
```

If TLSv1_2 is rejected, try `--secure-protocol=TLSv1_3`. Some older FTP servers only support earlier TLS versions, so adjust until the handshake succeeds.

## Quick Downloads

Use these when you need a listing or a single file without mirroring the full tree. Passive mode is the default for most clients and works through most NAT and firewall configurations.

```bash
wget -m ftp://anonymous:anonymous@$TARGET_IP/
```

**For FTPS**: curl with `--ssl-reqd` enforces TLS and refuses plain FTP connections. Use this when the server requires encryption but wget fails the handshake.

```bash
curl --ssl-reqd ftp://anonymous:anonymous@$TARGET_IP/
```

Focus on writable directories and unusual files during review. World-writable directories are potential upload points; verify whether any server process executes files placed there. Look for backup archives, SQL dumps, `.env` files, and web application configuration files. Credential files like `.htpasswd` or `config.php` are common finds on misconfigured FTP servers. Files with predictable names but non-zero sizes inside otherwise empty directories are worth pulling immediately.