Skip to content
HackIndex logo

HackIndex

FTP Anonymous Access Check

2 min read Mar 16, 2026

Anonymous FTP allows unauthenticated users to log in with the username anonymous and any string as a password. When enabled, it exposes every file in the FTP root to anyone who can reach the port. Write access to a directory served by a web server creates a direct path to remote code execution.

This page confirms the condition exists and what access level it grants. Exploitation of confirmed anonymous access is covered in FTP Anonymous Login Exploitation.

Check with nmap

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p $PORT --script ftp-anon $TARGET_IP 
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--    1 0        0             123 Jan 10 12:00 notes.txt
| drwxr-xr-x    2 0        0            4096 Jan 10 12:00 pub
|_drwxrwxrwx    2 1000     1000         4096 Jan 10 12:00 uploads

Anonymous FTP login allowed confirms the condition. The file listing shows what is immediately accessible. A directory listed as drwxrwxrwx has world-write permissions, confirming upload is possible.

Manual Verification

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP $PORT

At the username prompt enter anonymous. At the password prompt enter any string or leave it blank. A 230 Login successful response confirms anonymous access.

┌──(kali㉿kali)-[~]
└─$ curl -s --user anonymous:anonymous ftp://$TARGET_IP:$PORT/

This lists the root directory contents without an interactive session. If the command returns file and directory names, anonymous read is confirmed.

Confirm Write Access

┌──(kali㉿kali)-[~]
└─$ curl -s --user anonymous:anonymous -T /tmp/testfile.txt ftp://$TARGET_IP:$PORT/uploads/testfile.txt

A successful upload with no error confirms write access. Check whether the file appeared:

┌──(kali㉿kali)-[~]
└─$ curl -s --user anonymous:anonymous ftp://$TARGET_IP:$PORT/uploads/

What Anonymous Access Enables

Read-only anonymous access exposes all files in the FTP root to unauthenticated users. This includes configuration files, credentials, private keys, and application data if the FTP root overlaps with application directories.

Write access to a directory served by a web server enables web shell upload and remote code execution without any credentials. Check whether the FTP root or any writable subdirectory is also reachable over HTTP. See FTP Web Shell Upload.

References