Skip to content
HackIndex.io

FTP Manual Enumeration Techniques

3 min read Created Dec 29, 2025 Last updated Aug 11, 2026

Manual interaction can reveal issues automated tools miss. Scanners grab banners and run scripts, but they skip subtle misconfigurations that only surface during live session inspection. Connect directly with the ftp client or netcat and work through each check manually before moving on.

  • Hidden file listing ls -a reveals dot files like .bash_history, .ssh, and .config that automated scans skip.
  • PASV IP leakage the passive mode response can expose internal network addresses behind NAT or load balancers.
  • SYST fingerprinting returns OS type and daemon hints without relying on banners.
  • Active/passive toggling switching modes bypasses firewalls and reveals advertised data port ranges.
  • Directory metadata dir and ls -lR show permissions, owners, and timestamps for timeline and user enumeration.

List Hidden Files

ftp > ls -a

Reveals dot files that may hold configs, backups, or leaked creds. Look for .bash_history, .ssh directories, .config files, and anything named with a dot prefix. If you find readable files, pull them down immediately with get <filename>. Credential material in dot files is common on misconfigured servers where the FTP root overlaps with a user home directory. Note every filename and check file sizes before downloading.

Check for Internal IP Leakage (PASV)

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 21
┌──(kali㉿kali)-[~]
└─$ PASV

Server response with a private IP (192.168.x.x, 10.x.x.x, 172.16-31.x.x) exposes internal network layout. The PASV response format is 227 Entering Passive Mode (h1,h2,h3,h4,p1,p2). The first four octets form the IP address. If that IP is internal and differs from the target you connected to, the server sits behind NAT or a load balancer. Record the subnet for later pivoting or network mapping.

For FTPS: Use the openssl wrapper and send PASV after TLS negotiation.

Toggle Passive/Active Mode

Inside ftp client:

ftp > passive
ftp > active

Switching modes can bypass firewalls or trigger different IP responses for reconnaissance. Active mode has the server initiate a data connection back to your client. Most firewalls block that inbound connection. Passive mode has the client initiate both connections, which works through NAT. If a transfer hangs or fails, switch modes and retry. Watch the passive response for the data port the server advertises. That port range tells you what the firewall permits.

Identify Server Type Manually

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 21
┌──(kali㉿kali)-[~]
└─$ SYST

Returns OS type and FTP daemon hints without relying on banners. Common responses are UNIX Type: L8 for Linux-based daemons and Windows_NT for IIS FTP. A UNIX response narrows the likely daemon to vsftpd, ProFTPD, or Pure-FTPd. A Windows response points to IIS or FileZilla Server. Cross-reference the SYST output against the initial banner to spot inconsistencies. Mismatched OS and daemon info sometimes indicates a proxy or gateway sitting in front of the real server.

Raw Directory Metadata

ftp > dir
ftp > ls -lR

Provides full permissions, owners, timestamps, and usernames for mapping and timeline analysis. World-writable directories are upload candidates. Note any directory owned by a service account alongside files that look like configuration or data exports. Timestamps show when the server last saw activity, which uploads are recent, and whether admin work is ongoing. Usernames in the owner column feed directly into your wordlist and user enumeration efforts elsewhere. Combine these with earlier enumeration to build a complete picture before moving to exploitation.