Skip to content
HackIndex logo

HackIndex

FTP:

Vulnerability Discovery

FTP vulns: anonymous access, cleartext creds, writable dirs, CVEs, backdoor

7 guides • Updated Mar 29, 2026
7 guides

FTP Anonymous Access Check

FTP Bounce Attack Check

FTP Cleartext Credential Transmission

FTP Version Vulnerability Check

Identifies FTP server versions with known CVEs by banner grabbing and cross-referencing against vulnerability databases to detect unpatched or outdated daemons.

FTP Writable Directory Check

ProFTPD 1.3.3c Backdoor Detection

vsftpd 2.3.4 Backdoor Detection

ProFTPD — backdoor detection (1.3.3c)

What this does:
Tests for the presence of the ProFTPD 1.3.3c backdoor (BID 45150).
The NSE script checks whether the service responds in a way consistent with the known backdoored version. By default, it uses a non-destructive id command purely to confirm the backdoor’s presence.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p "$TARGET_PORT" --script ftp-proftpd-backdoor "$TARGET_IP"

Record:

  • Detected ProFTPD version/banner

  • Whether the backdoor check returned a positive result

  • Script output (confirmed vs not detected)

In order to exploit this backdoor you can follow this page: ProFTPD 1.3.3c Backdoor

vsftpd — backdoor detection (2.3.4)

What this does:
Tests for the vsftpd 2.3.4 backdoor disclosed in July 2011 (CVE-2011-2523).
The script verifies whether the FTP service behaves like the backdoored version, again using a harmless id command by default to validate exposure.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p "$TARGET_PORT" --script ftp-vsftpd-backdoor "$TARGET_IP"

Record:

  • Detected vsftpd version/banner

  • Whether the backdoor was identified

  • Any anomalous responses indicating compromise

In order to exploit this backdoor you can follow this page: vsftpd 2.3.4 Backdoor

Notes

  • These are the only FTP backdoor/vulnerability detection scripts provided by Nmap for ProFTPD and vsftpd.

  • Results should be treated as confirmation checks, not broad vulnerability coverage.

  • Use -Pn if the target blocks ICMP probes.

  • Save output for documentation and reporting

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p "$TARGET_PORT" --script ftp-proftpd-backdoor,ftp-vsftpd-backdoor "$TARGET_IP" -oN "ftp_nmap_${TARGET_IP}.txt"

References