Skip to content
HackIndex.io

FTP:

Vulnerability Discovery

FTP vulns: anonymous access, cleartext creds, writable dirs, CVEs, backdoor

7 guides • Created Dec 28, 2025 • Updated Mar 29, 2026
7 guides

FTP Anonymous Access Check

Detect misconfigured FTP servers allowing unauthenticated anonymous logins, exposing sensitive files or enabling unauthorised data upload/download.

Mar 16, 2026 • 3 min read

FTP Bounce Attack Check

Exploits misconfigured FTP servers using PORT command to proxy scans or connections through a third-party host, bypassing firewall restrictions.

Mar 16, 2026 • 3 min read

FTP Cleartext Credential Transmission

Identifies FTP services transmitting credentials in cleartext, demonstrating sniffable authentication and the risks of unencrypted legacy file transfer protocols.

Mar 16, 2026 • 3 min read

FTP Version Vulnerability Check

Identifies FTP server versions with known CVEs by banner grabbing and cross-referencing against vulnerability databases to detect unpatched or outdated daemons.

Mar 16, 2026 • 3 min read

FTP Writable Directory Check

Identifies writable FTP directories by testing anonymous or authenticated access, enabling upload of malicious files or further exploitation of misconfigured servers.

Mar 29, 2026 • 3 min read

ProFTPD 1.3.3c Backdoor Detection

Detect and exploit the ProFTPD 1.3.3c supply-chain backdoor (CVE-2010-4221) introduced via compromised source, enabling unauthenticated remote root access.

Mar 16, 2026 • 3 min read

ProFTPD , backdoor detection (1.3.3c)

What this does:
Tests for the presence of the ProFTPD 1.3.3c backdoor (BID 45150).
The NSE script checks whether the service responds in a way consistent with the known backdoored version. By default, it uses a non-destructive id command purely to confirm the backdoor’s presence.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p "$TARGET_PORT" --script ftp-proftpd-backdoor "$TARGET_IP"

Record:

  • Detected ProFTPD version/banner

  • Whether the backdoor check returned a positive result

  • Script output (confirmed vs not detected)

In order to exploit this backdoor you can follow this page: ProFTPD 1.3.3c Backdoor

vsftpd , backdoor detection (2.3.4)

What this does:
Tests for the vsftpd 2.3.4 backdoor disclosed in July 2011 (CVE-2011-2523).
The script verifies whether the FTP service behaves like the backdoored version, again using a harmless id command by default to validate exposure.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p "$TARGET_PORT" --script ftp-vsftpd-backdoor "$TARGET_IP"

Record:

  • Detected vsftpd version/banner

  • Whether the backdoor was identified

  • Any anomalous responses indicating compromise

In order to exploit this backdoor you can follow this page: vsftpd 2.3.4 Backdoor

Notes

  • These are the only FTP backdoor/vulnerability detection scripts provided by Nmap for ProFTPD and vsftpd.

  • Results should be treated as confirmation checks, not broad vulnerability coverage.

  • Use -Pn if the target blocks ICMP probes.

  • Save output for documentation and reporting

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p "$TARGET_PORT" --script ftp-proftpd-backdoor,ftp-vsftpd-backdoor "$TARGET_IP" -oN "ftp_nmap_${TARGET_IP}.txt"

References