Skip to content
HackIndex.io

FTP NSE Script Enumeration

3 min read Created Dec 29, 2025 Last updated Aug 11, 2026

Automated enumeration using safe NSE scripts only.

FTP is a frequent source of anonymous access, version disclosure, and weak TLS configuration. NSE scripts let you extract that information quickly without touching brute-force or exploit modules. Safe scripts limit themselves to authentication with credentials the server offers or standard protocol commands. They produce no significant impact on a healthy FTP service.

The two most useful scripts are ftp-anon and ftp-syst. Run them together on port 21 first before expanding the script set.

Quick Targeted Checks

┌──(kali㉿kali)-[~]
└─$ nmap -p 21 --script ftp-anon,ftp-syst $TARGET_IP 
PORT   STATE SERVICE
21/tcp open  ftp
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--   1 1170     924            31 Mar 28  2001 .banner
| d--x--x--x   2 root     root         1024 Jan 14  2002 bin
| d--x--x--x   2 root     root         1024 Aug 10  1999 etc
| drwxr-srwt   2 1170     924          2048 Jul 19 18:48 incoming [NSE: writeable]
| d--x--x--x   2 root     root         1024 Jan 14  2002 lib
| drwxr-sr-x   2 1170     924          1024 Aug  5  2004 pub
|_Only 6 shown. Use --script-args ftp-anon.maxlist=-1 to see all.
| ftp-syst:
|   SYST: Version: Linux 2.6.26.8-rt16
|   STAT:
|  HES_CPE FTP server status:
|      ftpd (GNU inetutils) 1.4.1
|      Connected to 72.14.177.105
|      Waiting for user name
|      TYPE: ASCII, FORM: Nonprint; STRUcture: File; transfer MODE: Stream
|      No data connection
|_End of status

The output shows anonymous login allowed alongside a directory listing. The [NSE: writeable] tag on the incoming directory is the key finding. A writeable directory on an anonymous FTP server is a direct path to file upload. Check whether that directory maps to a web root or is accessible over HTTP before moving on.

The ftp-syst response leaks OS type and daemon version. Cross-reference the version string against known CVEs. An outdated ftpd on a legacy kernel is a clear signal to investigate further.

Full Safe FTP Enumeration

┌──(kali㉿kali)-[~]
└─$ nmap -p 21 --script "ftp-* and not ftp-brute and not ftp-vuln*" $TARGET_IP

Excludes brute-force and known CVE checks. Run those separately in scopes where they are explicitly approved.

The wildcard filter covers every safe FTP script in one pass. Use it as a second sweep after confirming the service is live and interactive with the targeted run above.

Common useful safe scripts:

  • ftp-anon: Attempts anonymous login and lists the root directory. Look for writeable directories, hidden files, and sensitive file names. If the server truncates the listing, add --script-args ftp-anon.maxlist=-1 to force a full list.

  • ftp-syst: Sends the SYST and STAT FTP commands. The SYST response leaks OS type and daemon name. The STAT response shows authentication state and transfer mode. Both are useful for service fingerprinting without active exploitation.

For FTPS-specific extras (if AUTH TLS advertised):

If port 21 advertises AUTH TLS in its feature list, the server supports explicit FTPS. Chain with SSL scripts:

┌──(kali㉿kali)-[~]
└─$ nmap -p 21 -sV --script ssl-cert,ssl-enum-ciphers $TARGET_IP

The ssl-cert script returns the certificate subject, issuer, validity dates, and Subject Alternative Names. Check the CN and SANs for internal hostnames or domain names not visible in DNS. An expired or self-signed certificate on a public-facing service is worth noting in the report.

ssl-enum-ciphers lists every cipher suite the server accepts and grades each one. Look for SSLv3, TLS 1.0, or RC4 entries. Weak cipher support does not grant direct access, but it indicates the server is likely unpatched in other areas. Note any weak ciphers in the report and flag FTPS findings separately from plaintext FTP results.

References