# FTP Anonymous Access Check

> Detect misconfigured FTP servers allowing unauthenticated anonymous logins, exposing sensitive files or enabling unauthorised data upload/download.

- **URL:** https://hackindex.io/services/ftp/vulnerability-discovery/ftp-anonymous-access
- **Path:** FTP > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/ftp/vulnerability-discovery.md)
- **Published:** 2026-03-16
- **Updated:** 2026-08-11

Anonymous FTP allows unauthenticated users to log in with the username `anonymous` and any string as a password. When enabled, it exposes every file in the FTP root to anyone who can reach the port. Write access to a directory served by a web server creates a direct path to remote code execution.

This page confirms the condition exists and what access level it grants. Exploitation of confirmed anonymous access is covered in [FTP Anonymous Login Exploitation](https://hackindex.io/services/ftp/exploitation/ftp-anonymous-login).

- **Nmap ftp-anon script** automated check that confirms anonymous login and lists accessible files with permission details.
- **Manual verification** connect with ftp or curl using anonymous credentials to confirm access independently.
- **Write access check** upload a test file to writable directories to confirm upload capability without credentials.
- **Web root overlap** writable FTP paths served by a web server create a direct path to remote code execution.

## Check with nmap

```bash
nmap -sV -p $PORT --script ftp-anon $TARGET_IP
# PORT   STATE SERVICE VERSION
# 21/tcp open  ftp     vsftpd 3.0.3
# | ftp-anon: Anonymous FTP login allowed (FTP code 230)
# | -rw-r--r--    1 0        0             123 Jan 10 12:00 notes.txt
# | drwxr-xr-x    2 0        0            4096 Jan 10 12:00 pub
# |_drwxrwxrwx    2 1000     1000         4096 Jan 10 12:00 uploads
```

`Anonymous FTP login allowed` confirms the condition. The file listing shows what is immediately accessible. A directory listed as `drwxrwxrwx` has world-write permissions, confirming upload is possible.

## Manual Verification

```bash
ftp $TARGET_IP $PORT
```

At the username prompt enter `anonymous`. At the password prompt enter any string or leave it blank. A `230 Login successful` response confirms anonymous access.

```bash
curl -s --user anonymous:anonymous ftp://$TARGET_IP:$PORT/
```

This lists the root directory contents without an interactive session. If the command returns file and directory names, anonymous read is confirmed.

## Confirm Write Access

```bash
curl -s --user anonymous:anonymous -T /tmp/testfile.txt ftp://$TARGET_IP:$PORT/uploads/testfile.txt
```

A successful upload with no error confirms write access. Check whether the file appeared:

```bash
curl -s --user anonymous:anonymous ftp://$TARGET_IP:$PORT/uploads/
```

## What Anonymous Access Enables

Read-only anonymous access exposes all files in the FTP root to unauthenticated users. This includes configuration files, credentials, private keys, and application data if the FTP root overlaps with application directories.

Write access to a directory served by a web server enables web shell upload and remote code execution without any credentials. Check whether the FTP root or any writable subdirectory is also reachable over HTTP. See [FTP Web Shell Upload](https://hackindex.io/services/ftp/exploitation/ftp-web-shell-upload).

## References

- [ftp-anon NSE Script](https://nmap.org/nsedoc/scripts/ftp-anon.html) - Checks for anonymous FTP login and lists accessible files