# FTP NSE Script Enumeration

> Enumerate FTP services using Nmap NSE scripts to identify anonymous access, brute-force credentials, and disclose vulnerabilities on port 21.

- **URL:** https://hackindex.io/services/ftp/enumeration/ftp-nse-script-enumeration
- **Path:** FTP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ftp/enumeration.md)
- **Published:** 2025-12-29
- **Updated:** 2026-08-11

Automated enumeration using **safe NSE scripts only**.

FTP is a frequent source of anonymous access, version disclosure, and weak TLS configuration. NSE scripts let you extract that information quickly without touching brute-force or exploit modules. Safe scripts limit themselves to authentication with credentials the server offers or standard protocol commands. They produce no significant impact on a healthy FTP service.

The two most useful scripts are `ftp-anon` and `ftp-syst`. Run them together on port 21 first before expanding the script set.

## Quick Targeted Checks

```bash
nmap -p 21 --script ftp-anon,ftp-syst $TARGET_IP
# PORT   STATE SERVICE
# 21/tcp open  ftp
# | ftp-anon: Anonymous FTP login allowed (FTP code 230)
# | -rw-r--r--   1 1170     924            31 Mar 28  2001 .banner
# | d--x--x--x   2 root     root         1024 Jan 14  2002 bin
# | d--x--x--x   2 root     root         1024 Aug 10  1999 etc
# | drwxr-srwt   2 1170     924          2048 Jul 19 18:48 incoming [NSE: writeable]
# | d--x--x--x   2 root     root         1024 Jan 14  2002 lib
# | drwxr-sr-x   2 1170     924          1024 Aug  5  2004 pub
# |_Only 6 shown. Use --script-args ftp-anon.maxlist=-1 to see all.
# | ftp-syst:
# |   SYST: Version: Linux 2.6.26.8-rt16
# |   STAT:
# |  HES_CPE FTP server status:
# |      ftpd (GNU inetutils) 1.4.1
# |      Connected to 72.14.177.105
# |      Waiting for user name
# |      TYPE: ASCII, FORM: Nonprint; STRUcture: File; transfer MODE: Stream
# |      No data connection
# |_End of status
```

The output shows anonymous login allowed alongside a directory listing. The `[NSE: writeable]` tag on the `incoming` directory is the key finding. A writeable directory on an anonymous FTP server is a direct path to file upload. Check whether that directory maps to a web root or is accessible over HTTP before moving on.

The `ftp-syst` response leaks OS type and daemon version. Cross-reference the version string against known CVEs. An outdated `ftpd` on a legacy kernel is a clear signal to investigate further.

## Full Safe FTP Enumeration

```bash
nmap -p 21 --script "ftp-* and not ftp-brute and not ftp-vuln*" $TARGET_IP
```

Excludes brute-force and known CVE checks. Run those separately in scopes where they are explicitly approved.

The wildcard filter covers every safe FTP script in one pass. Use it as a second sweep after confirming the service is live and interactive with the targeted run above.

Common useful safe scripts:

- `ftp-anon`: Attempts anonymous login and lists the root directory. Look for writeable directories, hidden files, and sensitive file names. If the server truncates the listing, add `--script-args ftp-anon.maxlist=-1` to force a full list.
- `ftp-syst`: Sends the `SYST` and `STAT` FTP commands. The `SYST` response leaks OS type and daemon name. The `STAT` response shows authentication state and transfer mode. Both are useful for service fingerprinting without active exploitation.

**For FTPS-specific extras** (if AUTH TLS advertised):

If port 21 advertises `AUTH TLS` in its feature list, the server supports explicit FTPS. Chain with SSL scripts:

```bash
nmap -p 21 -sV --script ssl-cert,ssl-enum-ciphers $TARGET_IP
```

The `ssl-cert` script returns the certificate subject, issuer, validity dates, and Subject Alternative Names. Check the CN and SANs for internal hostnames or domain names not visible in DNS. An expired or self-signed certificate on a public-facing service is worth noting in the report.

`ssl-enum-ciphers` lists every cipher suite the server accepts and grades each one. Look for SSLv3, TLS 1.0, or RC4 entries. Weak cipher support does not grant direct access, but it indicates the server is likely unpatched in other areas. Note any weak ciphers in the report and flag FTPS findings separately from plaintext FTP results.

## References

- [NMAP ftp-anon NSE script](https://nmap.org/nsedoc/scripts/ftp-anon.html) - Checks if an FTP server allows anonymous logins.
- [NMAP ftp-syst NSE script](https://nmap.org/nsedoc/scripts/ftp-syst.html) - Sends FTP SYST and STAT commands and returns the result.