Skip to content
HackIndex logo

HackIndex

FTP Bounce Attack Exploitation

3 min read Mar 16, 2026

A confirmed FTP bounce (covered in FTP Bounce Attack Check) turns the FTP server into a scanning proxy. The server initiates connections on your behalf to third-party hosts, allowing you to reach internal systems that have no direct route to your machine. All connections originate from the FTP server's IP, so firewall rules blocking your source address do not apply.

Scan Internal Hosts via FTP Bounce with nmap

nmap has native support for FTP bounce scanning:

┌──(kali㉿kali)-[~]
└─$ nmap -b anonymous:anonymous@$TARGET_IP:$PORT INTERNAL_TARGET_IP

Replace INTERNAL_TARGET_IP with an internal host identified through ARP, routing tables, or other enumeration. nmap uses the FTP server's PORT command capability to open data connections to each port on the internal target and determines open vs closed from the response.

With a specific port range:

┌──(kali㉿kali)-[~]
└─$ nmap -b anonymous:anonymous@$TARGET_IP:$PORT -p 22,80,443,445,3389,8080 INTERNAL_TARGET_IP

Authenticated bounce if anonymous is not permitted:

┌──(kali㉿kali)-[~]
└─$ nmap -b $USER:$PASSWORD@$TARGET_IP:$PORT INTERNAL_TARGET_IP

Manual PORT Command Abuse

The PORT command format encodes the destination IP and port as six comma-separated decimal values. The IP 10.10.20.5 on port 80 encodes as 10,10,20,5,0,80 because the port is split into p1 * 256 + p2, so 80 = 0 * 256 + 80.

Connect to the FTP server:

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP $PORT 
PORT 10,10,20,5,0,80
LIST

Responses:

  • 150 Opening data connection followed by a listing or data means port 80 on 10.10.20.5 is open and the server connected

  • 425 Failed to establish connection means the connection attempt was made but the port is closed or filtered

  • 500 Illegal PORT command means the server blocked the third-party PORT attempt

Iterate through ports by repeating the PORT and LIST commands with different port values. This is slow manually — use nmap's -b option for any real scanning.

Port Encoding Reference

For port scanning via bounce, compute the two port encoding values:

p1 = port // 256
p2 = port % 256

Examples:

  • Port 22: 0,22

  • Port 80: 0,80

  • Port 443: 1,187

  • Port 445: 1,189

  • Port 3389: 13,69

  • Port 8080: 31,144

Full PORT command for 10.10.20.5 port 445: PORT 10,10,20,5,1,189

What Bounce Scanning Reveals

The bounce scan maps what services are accessible from the FTP server's network position, not from yours. Hosts and ports that show open through the bounce but are unreachable directly from your machine indicate the FTP server has additional network access. Use this to identify database servers, internal web applications, management interfaces, and other services on segments you cannot reach directly.

Once internal services are identified, set up tunnelling through the FTP server or another pivot to interact with them. SSH port forwarding and proxychains options are covered in the Linux lateral movement pages.

References