Skip to content
HackIndex logo

HackIndex

FTP Permission & Upload Testing

1 min read Jan 4, 2026

This phase identifies write access and dangerous misconfigurations.

Spot Writable Directories

Look for directories showing drwxrwxrwt or group/world write bits during enumeration. Common targets: /incoming, /upload, /pub, /tmp.

Manual verification inside an active session:

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP 
ftp> pwd
ftp> ls -la
ftp> mkdir .testdir
ftp> rmdir .testdir

Successful creation and removal confirms write access in the current directory.

Basic Upload Test

┌──(kali㉿kali)-[~]
└─$ echo "HackIndex upload test - $(date)" > test.txt
curl -T test.txt ftp://anonymous:anonymous@$TARGET_IP/incoming/

Verify upload:

┌──(kali㉿kali)-[~]
└─$ curl ftp://anonymous:anonymous@$TARGET_IP/incoming/test.txt

For FTPS:

┌──(kali㉿kali)-[~]
└─$ curl --ssl-reqd -T test.txt ftps://anonymous:anonymous@$TARGET_IP/incoming/

Upload with lftp

┌──(kali㉿kali)-[~]
└─$ lftp -u anonymous,anonymous ftp://$TARGET_IP 
> cd incoming
> put test.txt
> ls -l test.txt
> bye

For FTPS:

┌──(kali㉿kali)-[~]
└─$ lftp -u anonymous,anonymous ftps://$TARGET_IP -e "set ssl:verify-certificate no; cd incoming; put test.txt; ls -l test.txt; bye"

Cleanup

Remove artifacts immediately:

┌──(kali㉿kali)-[~]
└─$ curl ftp://user:pass@$TARGET_IP/incoming/ --quote "DELE test.txt"

Writable directories combined with weak authentication or web exposure often lead to full compromise.