Skip to content
HackIndex logo

HackIndex

NFS Share Content Enumeration

1 min read Jan 4, 2026

Remote listing exposes directory contents and metadata on accessible exports. Success reveals sensitive files without local mount.

Nmap nfs-ls

File and directory listing:

┌──(kali㉿kali)-[~]
└─$ nmap -p 2049 --script nfs-ls $TARGET_IP 
| nfs-ls:
|   Volume /mnt/nfs/files
|   access: Read Lookup NoModify NoExtend NoDelete NoExecute
|   PERMISSION  UID   GID   SIZE     MODIFICATION TIME  FILENAME
|   drwxr-xr-x  1000  100   4096     2010-06-17 12:28   /mnt/nfs/files
|   drwxr--r--  1000  1002  4096     2010-05-14 12:58   sources
|   -rw-------  1000  1002  23606    2010-06-17 12:28   notes
|
|   Volume /home/storage/backup
|   access: Read Lookup Modify Extend Delete NoExecute
|   PERMISSION  UID   GID   SIZE     MODIFICATION TIME  FILENAME
|   drwxr-xr-x  1000  100   4096     2010-06-11 22:31   /home/storage/backup
|   -rw-r--r--  1000  1002  0        2010-06-10 08:34   filetest
|   drwx------  1000  100   16384    2010-02-05 17:05   lost+found
|   -rw-r--r--  0     0     5        2010-06-10 11:32   rootfile
|   lrwxrwxrwx  1000  1002  8        2010-06-10 08:34   symlink

Enumerates exports with paths, permissions, owners.

Filesystem stats:

┌──(kali㉿kali)-[~]
└─$ nmap -p 2049 --script nfs-statfs $TARGET_IP 
| nfs-statfs:
|   Filesystem           1K-blocks  Used     Available  Use%  Blocksize
|   /mnt/nfs/files       5542276    2732012  2528728    52%   4096
|_  /mnt/nfs/opensource  5534416    620640   4632644    12%   4096

Disk usage and limits per export.

References