Skip to content
HackIndex logo

HackIndex

FTP Log Analysis

3 min read Mar 16, 2026

FTP logs record every connection, authentication attempt, and file transfer. Because FTP transmits credentials in plaintext, the logs sometimes contain the actual passwords entered by users — particularly when login failures are logged with the attempted credential. Logs also reveal active accounts, login patterns, and source IP addresses that map the environment.

Locate FTP Log Files

Log locations vary by daemon and distribution:

┌──(kali㉿kali)-[~]
└─$ # vsftpd
┌──(kali㉿kali)-[~]
└─$ cat /var/log/vsftpd.log
┌──(kali㉿kali)-[~]
└─$ cat /var/log/xferlog
 
┌──(kali㉿kali)-[~]
└─$ # ProFTPD
┌──(kali㉿kali)-[~]
└─$ cat /var/log/proftpd/proftpd.log
┌──(kali㉿kali)-[~]
└─$ cat /var/log/proftpd/xferlog
 
┌──(kali㉿kali)-[~]
└─$ # General FTP transfer log
┌──(kali㉿kali)-[~]
└─$ cat /var/log/xferlog
 
┌──(kali㉿kali)-[~]
└─$ # System auth log also captures FTP PAM events
┌──(kali㉿kali)-[~]
└─$ cat /var/log/auth.log | grep -i ftp
┌──(kali㉿kali)-[~]
└─$ cat /var/log/secure | grep -i ftp
 
┌──(kali㉿kali)-[~]
└─$ # Check syslog for FTP messages
┌──(kali㉿kali)-[~]
└─$ grep -i ftp /var/log/syslog

If you cannot find logs in standard locations, check the daemon config for a custom log path:

┌──(kali㉿kali)-[~]
└─$ grep -i "log\|xfer" /etc/vsftpd.conf /etc/proftpd/proftpd.conf 2>/dev/null

Extract User Accounts from Logs

┌──(kali㉿kali)-[~]
└─$ grep "LOGIN\|USER\|login\|user" /var/log/vsftpd.log | awk '{print $NF}' | sort -u

ProFTPD logs include the username on each line:

┌──(kali㉿kali)-[~]
└─$ grep "USER" /var/log/proftpd/proftpd.log | awk '{print $9}' | sort -u

This reveals every account that has connected to the FTP server, including service accounts and automated scripts that may use dedicated credentials.

Extract Source IP Addresses

┌──(kali㉿kali)-[~]
└─$ grep "CONNECT\|connect\|LOGIN\|login" /var/log/vsftpd.log | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort -u

Client IP addresses reveal which machines connect to the FTP server. In environments where credentials are reused, these machines are targets for the same credentials recovered from FTP.

Look for Failed Login Attempts with Attempted Passwords

Some FTP daemons log failed authentication in a way that includes or implies the attempted password. PAM-based authentication failures may appear in auth.log:

┌──(kali㉿kali)-[~]
└─$ grep -i "fail\|invalid\|incorrect\|wrong" /var/log/auth.log | grep -i ftp
┌──(kali㉿kali)-[~]
└─$ grep -i "fail\|invalid\|incorrect\|wrong" /var/log/vsftpd.log

In environments where users mistype their password or accidentally put the password in the username field, these logs capture the credential:

Mon Mar 10 09:45:12 2025 [pid 1234] FAIL LOGIN: Client "10.10.10.20", user "svcadmin"
Mon Mar 10 09:45:14 2025 [pid 1234] FAIL LOGIN: Client "10.10.10.20", user "Summer2024!"

The second entry shows the password typed into the username field.

File Transfer History

The xferlog format records every file transferred:

┌──(kali㉿kali)-[~]
└─$ cat /var/log/xferlog 
Mon Mar 10 09:30:01 2025 1 10.10.10.20 1234 /var/ftp/backup.tar.gz b _ o r svcadmin ftp 0 * c

Fields of interest: source IP, filename, transfer direction, and username. This reveals what files have been transferred and by whom, which identifies where sensitive data may have already moved and what files are considered important enough to transfer regularly.

ProFTPD SQL Logging

ProFTPD with mod_sql_log writes to a database instead of flat files. If SQL logging is configured, query the database directly with the credentials found in the ProFTPD config:

┌──(kali㉿kali)-[~]
└─$ mysql -u $USER -p$PASSWORD -h 127.0.0.1 -e "SELECT * FROM ftplog ORDER BY id DESC LIMIT 50;" proftpd

Replace table and database names based on what the config specifies.

Correlate with Other Logs

Cross-reference FTP login times and source IPs with SSH and web server logs to build a fuller picture of user activity patterns:

┌──(kali㉿kali)-[~]
└─$ grep "10.10.10.20" /var/log/auth.log | grep sshd
┌──(kali㉿kali)-[~]
└─$ grep "10.10.10.20" /var/log/apache2/access.log

The same source IP connecting to FTP and SSH suggests shared credentials between the services.

References