Skip to content
HackIndex logo

HackIndex

FTP Bounce Attack Check

2 min read Mar 16, 2026

The FTP bounce attack abuses the PORT command in active mode FTP. Normally, PORT tells the server where to send data back to the client. A vulnerable server will accept a PORT command pointing at a third-party host and port rather than the actual client, turning the FTP server into a proxy for connecting to internal hosts. This allows scanning internal network segments that are not directly reachable from your position.

Modern FTP servers block this by default, but misconfigured or legacy servers still allow it.

Detect with nmap

┌──(kali㉿kali)-[~]
└─$ nmap -p $PORT --script ftp-bounce $TARGET_IP 
PORT   STATE SERVICE
21/tcp open  ftp
|_ftp-bounce: bounce working!

bounce working! confirms the server accepts third-party PORT commands. The NSE script tests this by attempting to connect to a known-closed port on a third host through the FTP server and observing the response.

A hardened server returns:

|_ftp-bounce: no banner

or

|_ftp-bounce: server forbids bouncing to low ports < 1024

Manual Verification

Connect to the FTP server with valid or anonymous credentials:

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP $PORT

Once authenticated, send a PORT command pointing to an internal address. The IP address in the PORT command is encoded as six comma-separated decimal values: four octets of the IP address followed by two values representing the port number as p1*256+p2.

For target 10.10.20.5 on port 80 the encoding is:

ftp > PORT 10,10,20,5,0,80

Then issue a LIST command. If the server attempts the connection rather than rejecting it, bounce is permitted:

ftp > LIST

A 425 Failed to establish connection response means the bounce attempt was made but the port was closed. A 150 Opening data connection means the connection succeeded through the bounce. Either response confirms the bounce is allowed.

What FTP Bounce Enables

A server that allows bounce can be used to scan internal hosts not directly reachable from your attack machine. The FTP server acts as the originating host for all connections, so firewall rules that block your IP do not apply. Internal services that trust the FTP server's IP address may also be reachable.

Exploitation of a confirmed bounce for internal scanning is covered in FTP Bounce Attack Exploitation.

References