Skip to content
HackIndex logo

HackIndex

FTP NSE Script Enumeration

2 min read Jan 4, 2026

Automated enumeration using safe NSE scripts only.

Quick Targeted Checks

┌──(kali㉿kali)-[~]
└─$ nmap -p 21 --script ftp-anon,ftp-syst $TARGET_IP 
PORT   STATE SERVICE
21/tcp open  ftp
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--   1 1170     924            31 Mar 28  2001 .banner
| d--x--x--x   2 root     root         1024 Jan 14  2002 bin
| d--x--x--x   2 root     root         1024 Aug 10  1999 etc
| drwxr-srwt   2 1170     924          2048 Jul 19 18:48 incoming [NSE: writeable]
| d--x--x--x   2 root     root         1024 Jan 14  2002 lib
| drwxr-sr-x   2 1170     924          1024 Aug  5  2004 pub
|_Only 6 shown. Use --script-args ftp-anon.maxlist=-1 to see all.
| ftp-syst:
|   SYST: Version: Linux 2.6.26.8-rt16
|   STAT:
|  HES_CPE FTP server status:
|      ftpd (GNU inetutils) 1.4.1
|      Connected to 72.14.177.105
|      Waiting for user name
|      TYPE: ASCII, FORM: Nonprint; STRUcture: File; transfer MODE: Stream
|      No data connection
|_End of status

Covers anonymous access, system details, and basic status.

Full Safe FTP Enumeration

┌──(kali㉿kali)-[~]
└─$ nmap -p 21 --script "ftp-* and not ftp-brute and not ftp-vuln*" $TARGET_IP

Excludes brute-force and known vuln checks (use those separately in controlled scopes).

Common useful safe scripts:

  • ftp-anon: Anonymous login and basic listing

  • ftp-syst: SYST/STAT responses for version/OS hints

For FTPS-specific extras (if AUTH TLS advertised):

Chain with SSL scripts:

┌──(kali㉿kali)-[~]
└─$ nmap -p 21 -sV --script ssl-cert,ssl-enum-ciphers $TARGET_IP

Pulls cert details and supported TLS ciphers/versions.

References