Skip to content
HackIndex.io

FTP:

Vulnerability Discovery

FTP vulns: anonymous access, cleartext creds, writable dirs, CVEs, backdoor

7 guides • Created Dec 28, 2025 • Updated Mar 29, 2026
7 guides

FTP Anonymous Access Check

Detect misconfigured FTP servers allowing unauthenticated anonymous logins, exposing sensitive files or enabling unauthorised data upload/download.

FTP Bounce Attack Check

Exploits misconfigured FTP servers using PORT command to proxy scans or connections through a third-party host, bypassing firewall restrictions.

FTP Cleartext Credential Transmission

Identifies FTP services transmitting credentials in cleartext, demonstrating sniffable authentication and the risks of unencrypted legacy file transfer protocols.

FTP Version Vulnerability Check

Identifies FTP server versions with known CVEs by banner grabbing and cross-referencing against vulnerability databases to detect unpatched or outdated daemons.

FTP Writable Directory Check

Identifies writable FTP directories by testing anonymous or authenticated access, enabling upload of malicious files or further exploitation of misconfigured servers.

ProFTPD 1.3.3c Backdoor Detection

Detect and exploit the ProFTPD 1.3.3c supply-chain backdoor (CVE-2010-4221) introduced via compromised source, enabling unauthenticated remote root access.

vsftpd 2.3.4 Backdoor Detection

ProFTPD , backdoor detection (1.3.3c)

What this does:
Tests for the presence of the ProFTPD 1.3.3c backdoor (BID 45150).
The NSE script checks whether the service responds in a way consistent with the known backdoored version. By default, it uses a non-destructive id command purely to confirm the backdoor’s presence.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p "$TARGET_PORT" --script ftp-proftpd-backdoor "$TARGET_IP"

Record:

  • Detected ProFTPD version/banner

  • Whether the backdoor check returned a positive result

  • Script output (confirmed vs not detected)

In order to exploit this backdoor you can follow this page: ProFTPD 1.3.3c Backdoor

vsftpd , backdoor detection (2.3.4)

What this does:
Tests for the vsftpd 2.3.4 backdoor disclosed in July 2011 (CVE-2011-2523).
The script verifies whether the FTP service behaves like the backdoored version, again using a harmless id command by default to validate exposure.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p "$TARGET_PORT" --script ftp-vsftpd-backdoor "$TARGET_IP"

Record:

  • Detected vsftpd version/banner

  • Whether the backdoor was identified

  • Any anomalous responses indicating compromise

In order to exploit this backdoor you can follow this page: vsftpd 2.3.4 Backdoor

Notes

  • These are the only FTP backdoor/vulnerability detection scripts provided by Nmap for ProFTPD and vsftpd.

  • Results should be treated as confirmation checks, not broad vulnerability coverage.

  • Use -Pn if the target blocks ICMP probes.

  • Save output for documentation and reporting

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p "$TARGET_PORT" --script ftp-proftpd-backdoor,ftp-vsftpd-backdoor "$TARGET_IP" -oN "ftp_nmap_${TARGET_IP}.txt"

References