Skip to content
HackIndex logo

HackIndex

FTP Manual Enumeration Techniques

1 min read Jan 4, 2026

Manual interaction can reveal issues automated tools miss.

List Hidden Files

ftp > ls -a

Reveals dot files that may hold configs, backups, or leaked creds.

Check for Internal IP Leakage (PASV)

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 21
PASV

Server response with a private IP (192.168.x.x, 10.x.x.x, 172.16-31.x.x) exposes internal network layout.

For FTPS: Use the openssl wrapper and send PASV after TLS negotiation.

Toggle Passive/Active Mode

Inside ftp client:

ftp > passive
ftp > active

Switching modes can bypass firewalls or trigger different IP responses for reconnaissance.

Identify Server Type Manually

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 21
SYST

Returns OS type and FTP daemon hints without relying on banners.

Raw Directory Metadata

ftp > dir
ftp > ls -lR

Provides full permissions, owners, timestamps, and usernames for mapping and timeline analysis.

Combine these with earlier enumeration to build a complete picture before moving to exploitation.